@statewalker/webrun-http-browser 0.6.5 → 0.7.1

package/dist/worker.js

@@ -0,0 +1,3780 @@
+//#region ../webrun-streams/dist/index.js
+function serializeError(error) {
+	if (error instanceof Error) {
+		const out = {
+			message: error.message,
+			stack: error.stack
+		};
+		const bag = error;
+		for (const key of Object.keys(bag)) out[key] = bag[key];
+		return out;
+	}
+	if (typeof error === "object" && error !== null) {
+		const bag = error;
+		return {
+			message: String(bag.message ?? error),
+			...bag
+		};
+	}
+	return { message: String(error) };
+}
+function deserializeError(error) {
+	const payload = typeof error === "string" ? { message: error } : error;
+	return Object.assign(new Error(payload.message), payload);
+}
+/**
+* The newAsyncGenerator function creates async generators from callback-based initialization
+* functions, providing a bridge between imperative event handling and declarative async
+* iteration patterns.
+*
+* The initialization function receives two callback functions that control the generator's
+* behavior. The `next` function yields values to consumers, while the `done` function
+* signals completion or error conditions. The initialization function can return a cleanup
+* function that will be called when the generator is closed or an error occurs.
+*
+* The generator manages an internal queue of values and completion signals, ensuring that
+* producers can yield values without overwhelming consumers. Proper backpressure is implemented
+* by having the `next` and `done` functions return promises that resolve only after the
+* consumer has processed the values. This prevents memory leaks and ensures that producers
+* are aware of whether their values were successfully handled.
+* The generator also handles cleanup by draining any remaining items in the queue and notifying
+* producers that their values were not processed if the generator is closed early. This ensures
+* that resources are properly managed and that no memory leaks occur.
+*
+* Example usage:
+* ```typescript
+* const asyncGen = newAsyncGenerator<number>((next, done) => {
+*   let count = 0;
+*   const interval = setInterval(() => {
+*     if (count < 5) {
+*       next(count++);
+*     } else {
+*       done();
+*       clearInterval(interval);
+*     }
+*   }, 1000);
+*   return () => clearInterval(interval); // Cleanup function
+* });
+* (async () => {
+*   for await (const num of asyncGen) {
+*     console.log(num); // Logs numbers 0 to 4 at 1 second intervals
+*   }
+*   console.log("Completed");
+* })();
+* ```
+* @template T The type of values yielded by the generator
+* @template E The type of errors that can be thrown; defaults to Error
+* @param init Initialization function that sets up the generator behavior with next/done callbacks;
+*  The first parameter - `next` function - is used to yield values to consumers;
+*  It returns a Promise<boolean> indicating whether the value was successfully handled;
+*  The second parameter - `done` function - is used to signal completion or error;
+*  It returns a Promise<boolean> indicating whether the completion was successfully handled;
+*  The initialization function can optionally return a cleanup function that will be called
+*  when the generator is closed or an error occurs;
+* @param skipValues If true, only the most recent value is kept in the queue,
+* skipping intermediate values (not consumed values are considered skipped);
+* This is useful for scenarios where only the latest value matters, such as UI updates.
+* Defaults to false, meaning all values are queued and processed in order.
+* @returns AsyncGenerator that properly manages backpressure and resource cleanup
+*/
+async function* newAsyncGenerator(init, skipValues = false) {
+	let head;
+	let tail;
+	/** Flag to prevent new values from being queued after generator closes */
+	let closed = false;
+	/** Wake-up function to notify the generator loop of new items */
+	let wakeUp;
+	/**
+	* Drains the internal queue, notifying all pending producers that their values
+	* were not processed due to generator closure. This prevents memory leaks and
+	* ensures proper backpressure signaling.
+	*/
+	const drainQueue = () => {
+		for (; head; head = head.next) {
+			closed = closed || head.done;
+			head.resolve(false);
+		}
+		tail = void 0;
+	};
+	/**
+	* Enqueues a value or completion signal with a promise that resolves when the item
+	* is processed. This enables backpressure by allowing producers to know when their
+	* values have been consumed.
+	*/
+	const enqueue = (params) => {
+		if (skipValues) drainQueue();
+		return !closed ? new Promise((resolve) => {
+			const next = {
+				...params,
+				next: void 0,
+				resolve
+			};
+			if (tail) tail.next = next;
+			tail = next;
+			if (!head) head = tail;
+			wakeUp?.();
+		}) : Promise.resolve(false);
+	};
+	/**
+	* Producer function to yield a value to consumers. Returns a promise that resolves
+	* to true if the value was successfully processed, false if the generator is closed
+	* or the value was skipped due to backpressure.
+	*/
+	const next = (value) => enqueue({
+		done: false,
+		value
+	});
+	/**
+	* Producer function to signal completion or error. Optional error parameter will
+	* cause the generator to throw that error to consumers.
+	*/
+	const done = (error) => enqueue({
+		done: true,
+		error
+	});
+	const unsubscribe = init(next, done);
+	try {
+		while (!closed) {
+			if (!head) {
+				await new Promise((resolve) => {
+					wakeUp = resolve;
+				}).then(() => {
+					wakeUp = void 0;
+				});
+				continue;
+			}
+			const slot = head;
+			head = head.next;
+			if (tail === slot) tail = head;
+			try {
+				if (slot.done) {
+					closed = true;
+					if (slot.error !== void 0) throw slot.error;
+					break;
+				}
+				yield slot.value;
+			} finally {
+				slot.resolve(true);
+			}
+		}
+	} finally {
+		/**
+		* Cleanup phase - ensures proper resource management and notification of any
+		* remaining producers. This runs whether the generator completes normally,
+		* encounters an error, or is closed early by the consumer.
+		*/
+		closed = true;
+		wakeUp?.();
+		if (typeof unsubscribe === "function") await unsubscribe();
+		/**
+		* Drain any remaining items in the queue and notify their producers that
+		* the values were not processed. This prevents memory leaks and ensures
+		* proper backpressure signaling.
+		*/
+		drainQueue();
+	}
+}
+/**
+* Inverse of {@link sendIterator}: turns a sequence of `{done, value, error}`
+* chunks (delivered to the supplied callback by `installer`) into an async
+* generator.
+*
+* The `installer` is given a `deliver` function. It should call `deliver`
+* once for each incoming chunk and may return a cleanup callback that
+* runs when the consumer stops iterating.
+*/
+function recieveIterator(installer) {
+	return newAsyncGenerator((next, done) => {
+		const cleanup = installer(async (chunk = { done: true }) => {
+			const { done: isDone = true, value, error } = chunk;
+			if (error) return await done(error);
+			if (isDone) return await done();
+			return await next(value);
+		});
+		if (cleanup) return async () => {
+			await cleanup();
+		};
+	});
+}
+/**
+* Drain an async iterator into a sink that consumes one chunk at a time.
+*
+* Each yielded value becomes `{ done: false, value }`. Completion emits
+* `{ done: true }`. If the iterator throws, the error is caught and the
+* final `done` chunk carries it so the peer can rethrow on its side.
+*/
+async function sendIterator(send, it) {
+	let error;
+	try {
+		for await (const value of it) await send({
+			done: false,
+			value
+		});
+	} catch (err) {
+		error = err;
+	} finally {
+		await send({
+			done: true,
+			error
+		});
+	}
+}
+const DEFAULT_CHUNK_SIZE = 16384;
+/**
+* Curried `Duplex`-shaped transformer that splits incoming `Uint8Array`s into
+* chunks no larger than `size` bytes. Empty input chunks are skipped; small
+* input chunks pass through unchanged (zero-copy `subarray` views are used
+* when splitting, so no allocation per chunk).
+*
+* Use to respect transport MTUs before reaching `channel.send`. Reassembly on
+* the receive side is not needed — consumers iterate a continuous byte stream.
+*/
+function toChunks(size = DEFAULT_CHUNK_SIZE) {
+	if (!(Number.isInteger(size) && size > 0)) throw new RangeError(`toChunks: size must be a positive integer, got ${size}`);
+	return async function* (input) {
+		for await (const block of input) {
+			if (block.byteLength === 0) continue;
+			if (block.byteLength <= size) {
+				yield block;
+				continue;
+			}
+			let offset = 0;
+			while (offset < block.byteLength) {
+				const end = Math.min(offset + size, block.byteLength);
+				yield block.subarray(offset, end);
+				offset = end;
+			}
+		}
+	};
+}
+//#endregion
+//#region ../webrun-http-streams/dist/index.js
+const CR = 13;
+const LF = 10;
+const EMPTY = /* @__PURE__ */ new Uint8Array(0);
+var ByteStreamError = class extends Error {
+	name = "ByteStreamError";
+};
+function toAsyncIterator(input) {
+	const asyncIter = input[Symbol.asyncIterator];
+	if (asyncIter) return asyncIter.call(input);
+	const syncIter = input[Symbol.iterator]();
+	return { next() {
+		return Promise.resolve(syncIter.next());
+	} };
+}
+/**
+* Discard an iterable we are contractually forbidden from consuming — a body
+* skipped for HEAD/204, or one abandoned because the peer reported an error.
+*
+* The `.next()` is not optional: `.return()` on a generator still in suspended
+* start is a no-op, so the body never runs and its `try/finally` never unwinds.
+* Without it a wrapped ReadableStream or socket is never cancelled.
+*/
+async function discard(source) {
+	if (source === void 0) return;
+	const it = toAsyncIterator(source);
+	try {
+		await it.next();
+		await it.return?.();
+	} catch {}
+}
+function concatChunks(parts, totalLen) {
+	if (parts.length === 1) {
+		const only = parts[0];
+		if (only !== void 0) return only;
+	}
+	const out = new Uint8Array(totalLen);
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.byteLength;
+	}
+	return out;
+}
+/**
+* Pull-based reader over a byte source. Holds at most one pending buffer, and
+* hands out `subarray` views rather than copies — a body never passes through
+* an allocation here.
+*/
+var ByteReader = class {
+	#iter;
+	#buf = EMPTY;
+	#done = false;
+	constructor(input) {
+		this.#iter = toAsyncIterator(input);
+	}
+	/** Bytes already pulled from the source but not yet consumed. */
+	bufferedLength() {
+		return this.#buf.byteLength;
+	}
+	/** Pull one more non-empty chunk. Returns false at end of stream. */
+	async #pull() {
+		if (this.#done) return false;
+		while (true) {
+			const next = await this.#iter.next();
+			if (next.done) {
+				this.#done = true;
+				return false;
+			}
+			const chunk = next.value;
+			if (chunk.byteLength === 0) continue;
+			this.#buf = this.#buf.byteLength === 0 ? chunk : concatChunks([this.#buf, chunk], this.#buf.byteLength + chunk.byteLength);
+			return true;
+		}
+	}
+	async peekByte() {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		return this.#buf[0];
+	}
+	/** Up to `max` bytes. `undefined` means end of stream. */
+	async readSome(max) {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		const take = Math.min(max, this.#buf.byteLength);
+		const out = this.#buf.subarray(0, take);
+		this.#buf = this.#buf.subarray(take);
+		return out;
+	}
+	/**
+	* One CRLF-terminated line, without the CRLF. A bare LF is rejected: real
+	* peers always send CRLF, and tolerating a bare LF is precisely the lenience
+	* that lets request smuggling through a proxy pair.
+	*
+	* The `maxBytes` bound is best-effort: it only rejects a line if the check
+	* happens to run before the line is fully buffered. A line already sitting in
+	* the buffer bypasses the check. Callers needing a hard per-line limit or
+	* aggregate bounds must keep their own running total.
+	*/
+	async readLine(maxBytes) {
+		let searched = 0;
+		while (true) {
+			const idx = this.#buf.indexOf(LF, searched);
+			if (idx !== -1) {
+				if (idx === 0 || this.#buf[idx - 1] !== CR) throw new ByteStreamError("bare LF line terminator; CRLF required");
+				const line = this.#buf.subarray(0, idx - 1);
+				this.#buf = this.#buf.subarray(idx + 1);
+				return line;
+			}
+			searched = this.#buf.byteLength;
+			if (searched > maxBytes) throw new ByteStreamError(`line exceeds ${maxBytes} bytes without CRLF`);
+			if (!await this.#pull()) throw new ByteStreamError(`stream ended after ${searched} bytes without CRLF`);
+		}
+	}
+	/** Everything not yet consumed, lazily. */
+	async *rest() {
+		while (true) {
+			if (this.#buf.byteLength > 0) {
+				const out = this.#buf;
+				this.#buf = EMPTY;
+				yield out;
+				continue;
+			}
+			if (!await this.#pull()) return;
+		}
+	}
+};
+/**
+* Raised for any byte sequence this codec refuses to interpret. Every case is
+* a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+* works.
+*/
+var HttpParseError = class extends Error {
+	name = "HttpParseError";
+};
+const NEWLINE = 10;
+/** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
+const MAX_ENVELOPE_BYTES = 65536;
+const encoder$1 = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
+/**
+* Encode an HTTP envelope plus optional body as one continuous byte stream:
+*
+*     <JSON.stringify(envelope)>\n<body bytes...>
+*
+* `JSON.stringify` with default whitespace never emits a literal `\n`, so the
+* first `0x0a` byte unambiguously terminates the envelope.
+*
+* This is the same wire shape used by the legacy `webrun-http-port` package.
+*/
+async function* encodeMessage(envelope, body) {
+	yield encoder$1.encode(`${JSON.stringify(envelope)}\n`);
+	if (!body) return;
+	for await (const chunk of body) if (chunk.byteLength > 0) yield chunk;
+}
+/**
+* Consume an envelope-then-body byte stream. Returns the parsed envelope and
+* an async iterable over the remaining body bytes.
+*/
+async function decodeMessage(input) {
+	const iter = toAsyncIterator(input);
+	const accum = [];
+	let accumLen = 0;
+	let before;
+	let tail;
+	while (true) {
+		const next = await iter.next();
+		if (next.done) throw new HttpParseError(`decodeMessage: stream ended after ${accumLen} bytes without delimiter (\\n)`);
+		const chunk = next.value;
+		if (chunk.byteLength === 0) continue;
+		const nl = chunk.indexOf(NEWLINE);
+		if (nl === -1) {
+			accum.push(chunk);
+			accumLen += chunk.byteLength;
+			if (accumLen > MAX_ENVELOPE_BYTES) throw new HttpParseError(`decodeMessage: envelope exceeds ${MAX_ENVELOPE_BYTES} bytes without delimiter (\\n)`);
+			continue;
+		}
+		accum.push(chunk.subarray(0, nl));
+		accumLen += nl;
+		before = concatChunks(accum, accumLen);
+		tail = chunk.subarray(nl + 1);
+		break;
+	}
+	let envelope;
+	try {
+		envelope = JSON.parse(decoder.decode(before));
+	} catch (err) {
+		throw new HttpParseError(`decodeMessage: malformed envelope JSON at bytes 0..${before.byteLength}: ${err.message}`);
+	}
+	async function* body() {
+		if (tail.byteLength > 0) yield tail;
+		while (true) {
+			const next = await iter.next();
+			if (next.done) return;
+			if (next.value.byteLength > 0) yield next.value;
+		}
+	}
+	return {
+		envelope,
+		body: body()
+	};
+}
+const OPEN_BRACE = 123;
+/**
+* The original wire format — `<JSON.stringify(envelope)>\n<body bytes…>` —
+* expressed as a `MessageCodec`. Direction-agnostic: requests and responses
+* serialise identically.
+*
+* Retained so a peer pair can be upgraded in either order; see ADR-0006.
+*/
+const jsonEnvelopeCodec = {
+	name: "json-envelope",
+	sniff: (byte) => byte === OPEN_BRACE,
+	encodeRequest: (env, body) => encodeMessage(env, body),
+	encodeResponse: (env, body) => encodeMessage(env, body),
+	decodeRequest: (input) => decodeMessage(input),
+	decodeResponse: (input) => decodeMessage(input)
+};
+const TCHAR = /* @__PURE__ */ new Set("!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+const SP = 32;
+const HTAB = 9;
+function isTokenChar(byte) {
+	return byte > SP && byte < 127 && TCHAR.has(String.fromCharCode(byte));
+}
+function isToken(value) {
+	if (value.length === 0) return false;
+	for (const ch of value) if (!TCHAR.has(ch)) return false;
+	return true;
+}
+/**
+* Header bytes are latin-1: byte-preserving, matching Node, and lossless
+* across a decode/encode round-trip. Control characters are rejected
+* separately by `assertValidHeaderValue`.
+*/
+function decodeLatin1(bytes) {
+	let out = "";
+	for (const byte of bytes) out += String.fromCharCode(byte);
+	return out;
+}
+function encodeLatin1(text) {
+	const out = new Uint8Array(text.length);
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code > 255) throw new HttpParseError(`not latin-1 encodable: ${JSON.stringify(text)}`);
+		out[i] = code;
+	}
+	return out;
+}
+const HOST_IP_LITERAL = /^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/;
+const HOST_REG_NAME = /^[A-Za-z0-9._~-]+(:\d{1,5})?$/;
+/**
+* Validates a value that is about to become (or was read as) a `Host`
+* header: untrusted input either way, so an unrecognised shape is a refusal,
+* not a guess. Rejects a present-but-empty value, one carrying userinfo
+* (`evil.com@good.com`), and — the reason this also runs on encode — one
+* smuggling a CRLF-terminated line into the authority of a caller-supplied
+* url. Never applied to trusted configuration (a codec's `opts.host`).
+*/
+function assertValidHost(host) {
+	if (!HOST_IP_LITERAL.test(host) && !HOST_REG_NAME.test(host)) throw new HttpParseError(`invalid Host header: ${JSON.stringify(host)}`);
+}
+/**
+* A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+* `<= 0x20` (space and every control character, CR/LF included) and nothing
+* `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+* caller-supplied url can never inject a second request line) and on decode
+* (so a relay that decodes then re-encodes can never put an embedded control
+* character back on the wire).
+*/
+function assertValidTarget(target) {
+	for (let i = 0; i < target.length; i++) {
+		const code = target.charCodeAt(i);
+		if (code <= SP || code >= 127) throw new HttpParseError(`invalid request-target: ${JSON.stringify(target)}`);
+	}
+}
+/**
+* Shared control-character check behind both `assertValidHeaderValue` and
+* `assertValidStatusText` — the two were previously checked by different,
+* looser rules (statusText only rejected CR/LF), which is exactly the
+* asymmetry class C1 and M5 are both instances of. `label` is prepended
+* verbatim to each message, so callers keep their own wording.
+*/
+function assertNoControlChars(label, value) {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code === 13 || code === 10) throw new HttpParseError(`${label} contains CR or LF`);
+		if (code < SP && code !== HTAB || code === 127) throw new HttpParseError(`${label} contains a control character`);
+		if (code > 255) throw new HttpParseError(`${label} is not latin-1 encodable`);
+	}
+}
+function assertValidHeaderValue(name, value) {
+	assertNoControlChars(`header "${name}" value`, value);
+}
+/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+function assertValidStatusText(value) {
+	assertNoControlChars("statusText", value);
+}
+function encodeHeaderLines(headers) {
+	let out = "";
+	for (const [name, value] of headers) {
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		assertValidHeaderValue(name, value);
+		out += `${name}: ${value}\r\n`;
+	}
+	return out;
+}
+/**
+* Read to the blank line. `alreadyUsed` is the byte count of the start line,
+* so the bound covers the whole head section rather than the headers alone.
+*/
+async function readHeaderSection(reader, maxHeaderBytes, alreadyUsed) {
+	const headers = [];
+	let used = alreadyUsed;
+	while (true) {
+		const remaining = maxHeaderBytes - used;
+		if (remaining <= 0) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		const lineBytes = await reader.readLine(remaining);
+		used += lineBytes.byteLength + 2;
+		if (used > maxHeaderBytes) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		if (lineBytes.byteLength === 0) return headers;
+		if (lineBytes[0] === SP || lineBytes[0] === HTAB) throw new HttpParseError("obs-fold header continuation is not accepted");
+		const line = decodeLatin1(lineBytes);
+		const colon = line.indexOf(":");
+		if (colon <= 0) throw new HttpParseError(`malformed header line: ${JSON.stringify(line)}`);
+		const name = line.slice(0, colon);
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		const value = line.slice(colon + 1).replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+		assertValidHeaderValue(name, value);
+		headers.push([name, value]);
+	}
+}
+function getAll(headers, name) {
+	const lower = name.toLowerCase();
+	return headers.filter(([k]) => k.toLowerCase() === lower).map(([, v]) => v);
+}
+function withoutHeaders(headers, names) {
+	const drop = new Set(names.map((n) => n.toLowerCase()));
+	return headers.filter(([k]) => !drop.has(k.toLowerCase()));
+}
+/**
+* Parse a `Content-Length` field into a single validated value.
+*
+* RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+* numbers (a relay may have appended one), so the list is folded; differing
+* values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+* by the encoder's declared-length check, which previously carried its own
+* copy that did NOT split on commas — so decode accepted `5, 5` while encode
+* rejected it, and a relay that decoded then re-encoded threw.
+*
+* Returns undefined when the field is absent.
+*/
+function parseContentLength(values) {
+	if (values.length === 0) return void 0;
+	const unique = new Set(values.flatMap((v) => v.split(",").map((s) => s.trim())));
+	if (unique.size !== 1) throw new HttpParseError(`conflicting Content-Length values: ${[...unique].join(", ")}`);
+	const raw = [...unique][0];
+	if (!/^\d{1,15}$/.test(raw)) throw new HttpParseError(`invalid Content-Length: ${JSON.stringify(raw)}`);
+	return Number(raw);
+}
+/**
+* Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+* 204 and 304. Defined once because the encoder must not frame a body for
+* them and the decoder must not try to read one — two lists that agreed today
+* and were free to drift tomorrow.
+*
+* A response to HEAD is also bodyless, but that depends on the request rather
+* than the status, so callers test it separately.
+*/
+function isBodylessStatus(status) {
+	return status < 200 || status === 204 || status === 304;
+}
+/**
+* RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+* message declaring both Content-Length and Transfer-Encoding is rejected
+* rather than resolved — disagreeing on which one wins is request smuggling.
+*/
+function resolveFraming(headers, version) {
+	const te = getAll(headers, "transfer-encoding");
+	const cl = getAll(headers, "content-length");
+	if (te.length > 0 && cl.length > 0) throw new HttpParseError("message declares both Content-Length and Transfer-Encoding; refusing (request smuggling)");
+	if (te.length > 0) {
+		const encodings = te.join(",").split(",").map((s) => s.trim().toLowerCase()).filter((s) => s !== "");
+		if (encodings.length !== 1 || encodings[0] !== "chunked") throw new HttpParseError(`unsupported Transfer-Encoding: ${JSON.stringify(te.join(", "))}`);
+		if (version === "HTTP/1.0") throw new HttpParseError("Transfer-Encoding is not valid in HTTP/1.0");
+		return { kind: "chunked" };
+	}
+	const length = parseContentLength(cl);
+	if (length !== void 0) return {
+		kind: "length",
+		length
+	};
+	return { kind: "none" };
+}
+const CRLF = /* @__PURE__ */ new Uint8Array([13, 10]);
+const LAST_CHUNK = /* @__PURE__ */ new Uint8Array([
+	48,
+	13,
+	10,
+	13,
+	10
+]);
+const encoder = /* @__PURE__ */ new TextEncoder();
+/**
+* Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
+* them in decimal is the defect note 15 found in @libp2p/http, and it is the
+* one that cannot be caught downstream: decimal digits are also valid hex, so
+* a conforming parser silently reads the wrong length.
+*
+* Zero-length source chunks are skipped; a zero-sized chunk on the wire is the
+* body terminator.
+*/
+async function* encodeChunked(body) {
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		yield encoder.encode(`${chunk.byteLength.toString(16)}\r\n`);
+		yield chunk;
+		yield CRLF;
+	}
+	yield LAST_CHUNK;
+}
+/**
+* Decode a chunked body, yielding data chunks as they arrive. Nothing is
+* accumulated: a chunk larger than the transport's frame is yielded in pieces.
+*/
+async function* decodeChunked(reader, maxLineBytes) {
+	while (true) {
+		const sizeLine = decodeLatin1(await reader.readLine(maxLineBytes));
+		const semicolon = sizeLine.indexOf(";");
+		const sizeText = semicolon === -1 ? sizeLine : sizeLine.slice(0, semicolon);
+		if (!/^[0-9a-fA-F]{1,32}$/.test(sizeText)) throw new HttpParseError(`invalid chunk size: ${JSON.stringify(sizeLine)}`);
+		const size = Number.parseInt(sizeText, 16);
+		if (!Number.isSafeInteger(size)) throw new HttpParseError(`chunk size is too large: ${JSON.stringify(sizeLine)}`);
+		if (size === 0) {
+			let used = 0;
+			while (true) {
+				const remaining = maxLineBytes - used;
+				if (remaining <= 0) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				const lineBytes = await reader.readLine(remaining);
+				used += lineBytes.byteLength + 2;
+				if (used > maxLineBytes) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				if (lineBytes.byteLength === 0) break;
+			}
+			return;
+		}
+		let remaining = size;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`chunk truncated: ${remaining} of ${size} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		try {
+			if ((await reader.readLine(2)).byteLength !== 0) throw new HttpParseError("chunk data not terminated by CRLF");
+		} catch (err) {
+			if (err instanceof ByteStreamError) throw new HttpParseError("chunk data not terminated by CRLF");
+			throw err;
+		}
+	}
+}
+const VERSIONS = /* @__PURE__ */ new Set(["HTTP/1.1", "HTTP/1.0"]);
+const ABSOLUTE_FORM = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+/**
+* One message per Duplex call (ADR-0006), so bytes after a complete message
+* are an error. Checked against what is ALREADY BUFFERED rather than by
+* awaiting end-of-stream: a live socket from a keep-alive peer never reaches
+* EOF, so awaiting one would hang instead of failing.
+*/
+function assertNoBufferedBytes(reader) {
+	const extra = reader.bufferedLength();
+	if (extra > 0) throw new HttpParseError(`${extra} trailing bytes after a complete message`);
+}
+/**
+* The public error contract (I2): everything leaving `decodeRequest` /
+* `decodeResponse` is an `HttpParseError`, whether the refusal happened
+* synchronously (a malformed start line or header) or lazily while the body
+* is later drained. `ByteStreamError` — the `ByteReader`'s own class, never
+* exported — is the one thing converted here, message and all preserved via
+* `cause`. Anything else is a genuine failure of the underlying source (a
+* dropped socket, say) and must reach the caller unchanged: blanket-catching
+* would hide that distinction.
+*/
+function toHttpParseError(err) {
+	if (err instanceof ByteStreamError) throw new HttpParseError(err.message, { cause: err });
+	throw err;
+}
+/** Applies `toHttpParseError` across the whole lifetime of a body generator. */
+async function* convertBodyErrors(source) {
+	try {
+		yield* source;
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function* readBody(reader, framing, opts, noneMeansEof) {
+	if (framing.kind === "chunked") {
+		yield* decodeChunked(reader, opts.maxHeaderBytes);
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (framing.kind === "length") {
+		let remaining = framing.length;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`body truncated: ${remaining} of ${framing.length} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (noneMeansEof) {
+		yield* reader.rest();
+		return;
+	}
+	assertNoBufferedBytes(reader);
+}
+/**
+* `readLine`'s bound is best-effort — it is skipped when the line is already
+* buffered — so a very long start line can reach these messages intact. Since
+* a refusal is now echoed back to the sender in a 400 body, quote only enough
+* to diagnose rather than reflecting the whole thing.
+*/
+function quoteLine(line) {
+	const MAX = 120;
+	return line.length <= MAX ? JSON.stringify(line) : `${JSON.stringify(line.slice(0, MAX))} (truncated from ${line.length} chars)`;
+}
+async function decodeRequest(input, opts) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const parts = startLine.split(" ");
+		if (parts.length !== 3) throw new HttpParseError(`malformed request line: ${quoteLine(startLine)}`);
+		const [method, target, version] = parts;
+		if (!isToken(method)) throw new HttpParseError(`invalid method: ${JSON.stringify(method)}`);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		if (target === "*") throw new HttpParseError("asterisk-form request target is not supported");
+		assertValidTarget(target);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const hosts = getAll(headers, "host");
+		if (hosts.length > 1) throw new HttpParseError("multiple Host headers");
+		const host = hosts[0];
+		let url;
+		if (target.startsWith("/")) {
+			if (version === "HTTP/1.1" && host === void 0) throw new HttpParseError("HTTP/1.1 request has no Host header");
+			if (host !== void 0) assertValidHost(host);
+			url = `${opts.scheme}://${host ?? opts.host}${target}`;
+		} else if (ABSOLUTE_FORM.test(target)) url = target;
+		else throw new HttpParseError(`unsupported request target: ${JSON.stringify(target)}`);
+		try {
+			new URL(url);
+		} catch {
+			throw new HttpParseError(`decoded url is not a valid URL: ${JSON.stringify(url)}`);
+		}
+		return {
+			envelope: {
+				url,
+				method,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, resolveFraming(headers, version), opts, false))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function decodeResponse(input, opts, method) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const firstSp = startLine.indexOf(" ");
+		if (firstSp === -1) throw new HttpParseError(`malformed status line: ${quoteLine(startLine)}`);
+		const version = startLine.slice(0, firstSp);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		const afterVersion = startLine.slice(firstSp + 1);
+		const secondSp = afterVersion.indexOf(" ");
+		const codeText = secondSp === -1 ? afterVersion : afterVersion.slice(0, secondSp);
+		if (!/^\d{3}$/.test(codeText)) throw new HttpParseError(`invalid status code: ${JSON.stringify(codeText)}`);
+		const status = Number(codeText);
+		const statusText = secondSp === -1 ? "" : afterVersion.slice(secondSp + 1);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const bodyless = isBodylessStatus(status) || method.toUpperCase() === "HEAD";
+		const framing = bodyless ? { kind: "none" } : resolveFraming(headers, version);
+		return {
+			envelope: {
+				status,
+				statusText,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, framing, opts, !bodyless))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+/** Headers the codec owns: a caller-supplied copy is dropped and re-derived. */
+const REQUEST_OWNED = [
+	"host",
+	"connection",
+	"transfer-encoding"
+];
+const RESPONSE_OWNED = ["connection", "transfer-encoding"];
+/**
+* Split a URL into an origin-form request target and an authority *without*
+* going through `new URL()`. `URL` normalises percent-encoding and would
+* re-serialise the target — which is the exact class of defect note 15 found
+* in @libp2p/http, where rebuilding the request line silently dropped
+* `url.search`. Here the target is a verbatim slice of the caller's string.
+*/
+function splitTarget(url, opts) {
+	if (url.startsWith("/")) {
+		assertValidTarget(url);
+		return {
+			target: url,
+			authority: opts.host
+		};
+	}
+	const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)([^#]*)/.exec(url);
+	if (!match) throw new HttpParseError(`cannot derive a request target from url: ${JSON.stringify(url)}`);
+	const rawAuthority = match[1];
+	if (rawAuthority === "") throw new HttpParseError(`url has no authority: ${JSON.stringify(url)}`);
+	const at = rawAuthority.lastIndexOf("@");
+	const authority = at === -1 ? rawAuthority : rawAuthority.slice(at + 1);
+	assertValidHost(authority);
+	const rawTarget = match[2];
+	const target = rawTarget === "" ? "/" : rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`;
+	assertValidTarget(target);
+	return {
+		target,
+		authority
+	};
+}
+async function* emitBody(body, declared) {
+	if (declared === void 0) {
+		yield* encodeChunked(body);
+		return;
+	}
+	let sent = 0;
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		sent += chunk.byteLength;
+		if (sent > declared) throw new HttpParseError(`body exceeds declared Content-Length ${declared} (${sent} bytes so far)`);
+		yield chunk;
+	}
+	if (sent !== declared) throw new HttpParseError(`body is ${sent} bytes but Content-Length declares ${declared}`);
+}
+async function* encodeRequest(env, body, opts) {
+	if (!isToken(env.method)) throw new HttpParseError(`invalid method: ${JSON.stringify(env.method)}`);
+	const { target, authority } = splitTarget(env.url, opts);
+	if (authority === "") throw new HttpParseError("no Host available: url has no authority and no host is configured");
+	const carried = withoutHeaders(env.headers, REQUEST_OWNED);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `${env.method} ${target} HTTP/1.1\r\n`;
+	head += `Host: ${authority}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+async function* encodeResponse(env, body, _opts, requestMethod) {
+	if (!Number.isInteger(env.status) || env.status < 100 || env.status > 599) throw new HttpParseError(`invalid status: ${env.status}`);
+	const reason = env.statusText ?? "";
+	assertValidStatusText(reason);
+	const bodylessStatus = isBodylessStatus(env.status);
+	const bodyless = bodylessStatus || requestMethod?.toUpperCase() === "HEAD";
+	const owned = bodylessStatus ? [...RESPONSE_OWNED, "content-length"] : RESPONSE_OWNED;
+	const carried = withoutHeaders(env.headers, owned);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `HTTP/1.1 ${env.status} ${reason}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (!bodyless && body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (bodyless) {
+		await discard(body);
+		return;
+	}
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+function newHttpCodec(options = {}) {
+	const opts = {
+		scheme: options.scheme ?? "http",
+		host: options.host ?? "localhost",
+		maxHeaderBytes: options.maxHeaderBytes ?? 65536
+	};
+	return {
+		name: "http/1.1",
+		sniff: (byte) => isTokenChar(byte),
+		encodeRequest: (env, body) => encodeRequest(env, body, opts),
+		encodeResponse: (env, body, o) => encodeResponse(env, body, opts, o?.method),
+		decodeRequest: (input) => decodeRequest(input, opts),
+		decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
+	};
+}
+const httpCodec = /* @__PURE__ */ newHttpCodec();
+/**
+* Dispatches on byte 0. The formats are self-identifying — a JSON envelope
+* always begins `{`, which is not a token character and so can never begin an
+* HTTP start-line — so no negotiation handshake, magic prefix, or version byte
+* is needed.
+*
+* This is what makes a mixed-version peer pair safe: readers accept either
+* format, so the two ends can be upgraded in any order.
+*/
+function newSniffingCodec(options) {
+	const { write, accept } = options;
+	async function pick(input) {
+		const reader = new ByteReader(input);
+		const first = await reader.peekByte();
+		if (first === void 0) throw new HttpParseError("sniff: stream ended before any bytes arrived");
+		const codec = accept.find((c) => c.sniff(first));
+		if (!codec) throw new HttpParseError(`sniff: no accepted codec recognises a message starting with byte 0x${first.toString(16).padStart(2, "0")}`);
+		return {
+			codec,
+			input: reader.rest()
+		};
+	}
+	return {
+		name: `sniff(write=${write.name}; accept=${accept.map((c) => c.name).join(",")})`,
+		sniff: (byte) => accept.some((c) => c.sniff(byte)),
+		encodeRequest: (env, body) => write.encodeRequest(env, body),
+		encodeResponse: (env, body, o) => write.encodeResponse(env, body, o),
+		decodeRequest: async (input) => {
+			const picked = await pick(input);
+			try {
+				return {
+					...await picked.codec.decodeRequest(picked.input),
+					codec: picked.codec
+				};
+			} catch (error) {
+				if (error !== null && typeof error === "object") error.codec = picked.codec;
+				throw error;
+			}
+		},
+		decodeResponse: async (input, o) => {
+			const picked = await pick(input);
+			return picked.codec.decodeResponse(picked.input, o);
+		}
+	};
+}
+/**
+* Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
+* no `codec` option is supplied.
+*/
+const defaultCodec = /* @__PURE__ */ newSniffingCodec({
+	write: httpCodec,
+	accept: [httpCodec, jsonEnvelopeCodec]
+});
+/**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable$2(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+/** Carries the serialized JS error between two webrun peers. */
+const PEER_ERROR_HEADER = "x-webrun-error";
+/** Hard cap on the peer-error header (M3): see `encodeErrorResponse`. */
+const MAX_DETAIL_CHARS = 4096;
+/**
+* JSON with every non-printable-ASCII character escaped, so the result is a
+* legal latin-1 header value whatever the error message contained.
+*/
+function asciiJson(value) {
+	return JSON.stringify(value).replace(/[^\x20-\x7E]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* Decision 13: a real HTTP peer cannot receive a JavaScript exception, only a
+* response. So an uncaught handler error becomes a conforming 500 whose body
+* carries the message, with the serialized error in a namespaced header that
+* another webrun peer re-throws from.
+*/
+function encodeErrorResponse(codec, error, method, status = 500, statusText = "Internal Server Error") {
+	const serialized = serializeError(error);
+	let detail = asciiJson(serialized);
+	if (detail.length > MAX_DETAIL_CHARS) detail = asciiJson({ message: serialized.message });
+	if (detail.length > MAX_DETAIL_CHARS) detail = detail.slice(0, MAX_DETAIL_CHARS);
+	const message = serialized.message ?? statusText;
+	return codec.encodeResponse({
+		status,
+		statusText,
+		headers: [["Content-Type", "text/plain; charset=utf-8"], [PEER_ERROR_HEADER, detail]]
+	}, [new TextEncoder().encode(message)], { method });
+}
+/**
+* `output` is the `Duplex` call's own generator — one logical call, per the
+* `Duplex` contract in `@statewalker/webrun-streams`: "Consumer `.return()`
+* on the output → producer's `finally` runs." On a mux transport
+* (`emulateMux`), that `finally` is what frees the stream-table slot; skip it
+* and every peer-error response leaks one slot, unboundedly, until the mux
+* itself is exhausted (`maxStreams` reached, every further call rejected).
+*
+* Cancelling `output` here — not inside the codec's own decode logic — is
+* deliberate. `codec.decodeResponse` already pulled from `output` to read the
+* head before this function runs, so unlike the body case above there's no
+* suspended-start no-op to worry about. And it's safe specifically *because*
+* this is the client's own response-only generator: the request was already
+* fully sent before we got here, so there is nothing left to write on it.
+* The equivalent is NOT safe inside `src/http1/decode.ts`'s `ByteReader` —
+* that code also runs when a caller wires `codec.decodeRequest`/
+* `decodeResponse` directly onto a raw bidirectional socket (see
+* `tests/http1-node-interop.test.ts`), where the *same* object is read from
+* and then written back to (a server reads the request, then replies on the
+* same socket); cancelling the read side there tears down the whole
+* connection out from under the pending write. That was tried and reverted —
+* see the Task 11 report for the "socket hang up" failure it caused.
+*/
+async function throwIfPeerError(result, output) {
+	const found = result.envelope.headers.find(([k]) => k.toLowerCase() === PEER_ERROR_HEADER);
+	if (!found) return;
+	await discard(result.body);
+	try {
+		await output.return?.(void 0);
+	} catch {}
+	let payload;
+	try {
+		payload = JSON.parse(found[1]);
+	} catch {
+		payload = { message: found[1] };
+	}
+	throw deserializeError(payload);
+}
+/**
+* Initiate an HTTP call over a `Duplex`. The caller's `call: Duplex` is
+* obtained from any `webrun-streams-*` adapter's `connect`. Returns the
+* response envelope and an async iterable over the response body bytes.
+*
+* The call is one logical Duplex invocation; multiplexing of concurrent
+* calls is the adapter's concern (native or `emulateMux`).
+*/
+async function httpFetch(call, env, body, options = {}) {
+	const codec = options.codec ?? defaultCodec;
+	const { signal } = options;
+	if (signal?.aborted) throw abortReason$1(signal);
+	const output = call(codec.encodeRequest(env, body));
+	let released;
+	const release = () => {
+		released ??= (async () => {
+			try {
+				await output.return?.(void 0);
+			} catch {}
+		})();
+		return released;
+	};
+	let finished = false;
+	const finish = () => {
+		if (finished || released) return;
+		finished = true;
+		if (signal?.aborted) {
+			release();
+			return;
+		}
+		const onAbort = () => void release();
+		signal?.addEventListener("abort", onAbort, { once: true });
+		drain(output).finally(() => signal?.removeEventListener("abort", onAbort));
+	};
+	let decoded;
+	try {
+		decoded = await untilAborted(codec.decodeResponse(output, { method: env.method }), signal);
+	} catch (error) {
+		if (signal?.aborted) release();
+		else await release();
+		throw error;
+	}
+	const result = {
+		envelope: decoded.envelope,
+		body: releasingOnExit(decoded.body, finish, release),
+		release,
+		finish
+	};
+	await throwIfPeerError(result, output);
+	return result;
+}
+/** `promise`, rejected with the signal's reason if it aborts first. */
+function untilAborted(promise, signal) {
+	if (!signal) return promise;
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(abortReason$1(signal));
+		if (signal.aborted) return onAbort();
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+/** The signal's reason as an `Error` (`AbortError` when it gave none). */
+function abortReason$1(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
+	err.name = "AbortError";
+	return err;
+}
+/**
+* `body`, ending the call however it is left: read to its end, or left early.
+*
+* The body the codec hands back is a generator of its own over a `ByteReader`,
+* and its ending never reaches the call's `output` (see `throwIfPeerError` for
+* why the codec must not do that itself). A caller that stopped reading — an
+* aborted `fetch`, a cancelled response stream — left the peer's producer
+* parked forever; and one that read the body to its end left the call itself
+* open, which on a multiplexed transport is one port per exchange until the
+* multiplexer refuses to open more (`maxPorts`).
+*
+* Left early, the call is abandoned (`.return()`): the peer's producer is
+* released. Read to its end, the call is not cut short but read to ITS end, in
+* the background: the peer ends it once its side of the exchange is over,
+* which may be later than the response — a handler that answered before it
+* read the request body is still receiving it (`HttpDataHandlerResult.settled`),
+* and abandoning the call would abort that upload.
+*/
+async function* releasingOnExit(body, finish, release) {
+	let completed = false;
+	try {
+		yield* body;
+		completed = true;
+	} finally {
+		if (completed) finish();
+		else await release();
+	}
+}
+/** Reads `output` to its end, discarding what is left, ignoring a failure. */
+async function drain(output) {
+	try {
+		for (let r = await output.next(); !r.done; r = await output.next());
+	} catch {}
+}
+/**
+* Wrap an HTTP handler as a `Duplex` so it can be registered with any
+* `webrun-streams-*` adapter's `serve`.
+*/
+function httpServe(handler, options = {}) {
+	const codec = options.codec ?? defaultCodec;
+	return async function* httpHandlerDuplex(input) {
+		let decoded;
+		try {
+			decoded = await codec.decodeRequest(input);
+		} catch (error) {
+			if (!(error instanceof HttpParseError)) throw error;
+			yield* encodeErrorResponse(error.codec ?? codec, error, "GET", 400, "Bad Request");
+			return;
+		}
+		const replyCodec = decoded.codec ?? codec;
+		let result;
+		try {
+			result = await handler(decoded.envelope, decoded.body);
+		} catch (error) {
+			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
+			return;
+		}
+		let completed = false;
+		try {
+			yield* replyCodec.encodeResponse(result.envelope, result.body, { method: decoded.envelope.method });
+			completed = true;
+			await result.settled?.();
+		} finally {
+			if (!completed) try {
+				await result.release?.();
+			} catch {}
+		}
+	};
+}
+/**
+* The one place that knows a runtime may not implement request body streams,
+* and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
+* carry a client and a server direction that must agree on the answer, so the
+* predicate lives here rather than being written out four times.
+*/
+/**
+* Whether `Request.prototype` exposes a `body` accessor. Two call sites read
+* that property, and two more depend on the constructor accepting a
+* `ReadableStream` as `init.body`; this predicate answers for all four.
+*
+* What was verified, and all that is claimed here: Firefox (146 at the time of
+* writing) has *neither*, and Chromium and Node have *both*. On Firefox it is
+* not that `body` is `undefined` on the instance —
+* `Object.getOwnPropertyDescriptor(Request.prototype, "body")` is `null`, the
+* accessor is genuinely absent — and because a `ReadableStream` is then not a
+* recognised `BodyInit`, the constructor falls through to the string branch and
+* stores the literal text `[object ReadableStream]`.
+*
+* The two halves are NOT guaranteed to ship together, so do not read this as a
+* test for "request streams" in general. Safari is the counterexample: it has
+* had `Request.body` since 11.1 but only accepts a stream as `init.body` from
+* Technology Preview 250, so a shipping Safari has the reader half without the
+* upload half and this returns `true` there. That looks benign — WebKit appears
+* to store the stream on the `Request` rather than stringify it, and its error
+* comes from `fetch()`, which this package never calls on the objects it builds
+* — but it is untested, and it is the case to look at first if a Safari report
+* arrives. The sharper probe, if one is ever needed, is whether
+* `new Request(url, {method:"POST", body:new ReadableStream(), duplex:"half"})`
+* has a `content-type` of `text/plain;charset=UTF-8` (stringified) or `null`
+* (stored); it is not used here because it costs a `Request` and a
+* `ReadableStream` per call and agrees with the descriptor check on every
+* runtime measured.
+*
+* A capability check, never a user-agent test: the question is what this
+* runtime does, and the answer flips on its own the day Firefox ships request
+* streams. Evaluated per call rather than cached at module load so that a test
+* can install a `Request` without the capability and exercise the real branch
+* under Node.
+*/
+function supportsRequestStreams() {
+	return typeof Request === "function" && Object.getOwnPropertyDescriptor(Request.prototype, "body") != null;
+}
+/**
+* Drain a body iterable into one contiguous buffer. Only the fallbacks need it.
+* Allocates its own buffer rather than reusing `bytes.ts`'s `concatChunks`,
+* which passes a single chunk straight through: that chunk is a view onto the
+* decoder's own read buffer, and the result here is handed to `new Request` and
+* outlives the decode. The allocation is also what makes it a
+* `Uint8Array<ArrayBuffer>`, which `BodyInit` accepts and the looser
+* `Uint8Array<ArrayBufferLike>` does not.
+*/
+async function collectBytes(source) {
+	const parts = [];
+	let total = 0;
+	for await (const chunk of source) {
+		if (chunk.byteLength === 0) continue;
+		parts.push(chunk);
+		total += chunk.byteLength;
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.byteLength;
+	}
+	return out;
+}
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+/**
+* Connection-scoped headers. The codec surfaces them verbatim (decision 12),
+* but they are meaningless to a `Request`/`Response`, and re-emitting them
+* from a relay would corrupt its framing.
+*/
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function forwardableHeaders(headers) {
+	return headers.filter(([name]) => !HOP_BY_HOP.has(name.toLowerCase()));
+}
+function headersToArray(headers) {
+	const out = [];
+	headers.forEach((value, key) => {
+		out.push([key, value]);
+	});
+	return out;
+}
+async function* readableToAsyncIterable(stream) {
+	if (!stream) return;
+	const reader = stream.getReader();
+	let consumed = false;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) {
+				consumed = true;
+				return;
+			}
+			if (value) yield value;
+		}
+	} finally {
+		if (!consumed) try {
+			await reader.cancel();
+		} catch {}
+		try {
+			reader.releaseLock();
+		} catch {}
+	}
+}
+function asyncIterableToReadable(iter) {
+	const it = iter[Symbol.asyncIterator]();
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				const { done, value } = await it.next();
+				if (done) {
+					controller.close();
+					return;
+				}
+				controller.enqueue(value);
+			} catch (err) {
+				controller.error(err);
+			}
+		},
+		async cancel() {
+			await it.return?.();
+		}
+	});
+}
+/**
+* Run a `Request` through a `Duplex` call and reconstruct the `Response` on
+* the other side. The request's `signal` is plumbed into the body iteration —
+* abort terminates the underlying call.
+*/
+async function fetchOverDuplex(call, request, options = {}) {
+	if (request.signal?.aborted) throw abortReason$1(request.signal);
+	const env = {
+		url: request.url,
+		method: request.method,
+		headers: headersToArray(request.headers)
+	};
+	let body;
+	if (request.body != null) body = readableToAsyncIterable(request.body);
+	else if (!supportsRequestStreams()) {
+		const buffered = new Uint8Array(await request.arrayBuffer());
+		if (buffered.byteLength > 0) body = [buffered];
+	}
+	const { envelope, body: respBody, release, finish } = await httpFetch(call, env, body, {
+		...options,
+		signal: request.signal ?? void 0
+	});
+	const responseInit = {
+		status: envelope.status,
+		statusText: envelope.statusText,
+		headers: forwardableHeaders(envelope.headers)
+	};
+	if (request.method === "HEAD" || request.method === "OPTIONS" || NULL_BODY_STATUSES.has(envelope.status)) {
+		if (finish) finish();
+		else await release?.();
+		return new Response(null, responseInit);
+	}
+	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
+}
+/**
+* Wrap a `(Request) => Promise<Response>` handler as a `Duplex` so it can be
+* registered with any `webrun-streams-*` adapter's `serve`.
+*/
+function serveFetchOverDuplex(handler, options = {}) {
+	return httpServe(async (env, body) => {
+		const reqInit = {
+			method: env.method,
+			headers: forwardableHeaders(env.headers)
+		};
+		let upload;
+		if (env.method !== "GET" && env.method !== "HEAD") {
+			if (supportsRequestStreams()) {
+				upload = trackingEnd(body);
+				reqInit.body = asyncIterableToReadable(upload.source);
+				reqInit.duplex = "half";
+			} else reqInit.body = await collectBytes(body);
+		}
+		const request = new Request(env.url, reqInit);
+		const response = await handler(request);
+		const settled = async () => {
+			if (!upload) return;
+			if (!request.bodyUsed && !request.body?.locked) request.body?.cancel().catch(() => {});
+			await upload.settle(options.requestIdleMs ?? 3e4);
+		};
+		const respEnv = {
+			status: response.status,
+			statusText: response.statusText,
+			headers: headersToArray(response.headers)
+		};
+		if (env.method === "HEAD" || env.method === "OPTIONS" || NULL_BODY_STATUSES.has(response.status)) {
+			await response.body?.cancel();
+			return {
+				envelope: respEnv,
+				body: void 0,
+				settled
+			};
+		}
+		return {
+			envelope: respEnv,
+			body: response.body ? readableToAsyncIterable(response.body) : void 0,
+			release: () => response.body?.cancel(),
+			settled
+		};
+	}, options);
+}
+/**
+* `source`, and `settle(idleMs)`: resolves once it is done — read to its end,
+* failed, or abandoned (`return()` included before the first `next()`, which a
+* generator's `finally` would not see) — or once nobody has asked it for a
+* chunk for `idleMs`, in which case it is abandoned: later reads fail.
+*
+* Idle counts only while no `next()` is pending: a reader waiting for a slow
+* sender is still reading.
+*/
+function trackingEnd(source) {
+	let end = () => {};
+	let isEnded = false;
+	const ended = new Promise((resolve) => {
+		end = () => {
+			isEnded = true;
+			resolve();
+		};
+	});
+	let abandoned;
+	let pending = 0;
+	let idleSince = Date.now();
+	const it = source[Symbol.asyncIterator]();
+	const abandon = (reason) => {
+		abandoned ??= reason;
+		end();
+		Promise.resolve(it.return?.(void 0)).catch(() => {});
+	};
+	const tracked = {
+		[Symbol.asyncIterator]() {
+			return tracked;
+		},
+		async next() {
+			if (abandoned) throw abandoned;
+			pending++;
+			try {
+				const r = await it.next();
+				if (r.done) end();
+				return r;
+			} catch (error) {
+				end();
+				throw error;
+			} finally {
+				if (--pending === 0) idleSince = Date.now();
+			}
+		},
+		async return(value) {
+			end();
+			try {
+				await it.return?.(value);
+			} catch {}
+			return {
+				done: true,
+				value: void 0
+			};
+		}
+	};
+	asyncDisposable$2(tracked, () => tracked.return?.() ?? Promise.resolve());
+	const settle = (idleMs) => {
+		if (isEnded || !Number.isFinite(idleMs)) return ended;
+		return new Promise((resolve) => {
+			let timer;
+			const check = () => {
+				if (isEnded) return resolve();
+				const idle = pending === 0 ? Date.now() - idleSince : 0;
+				if (idle >= idleMs) {
+					abandon(/* @__PURE__ */ new Error(`webrun-http-streams: the request body was left unread for ${idleMs} ms after the response; abandoned`));
+					return resolve();
+				}
+				timer = setTimeout(check, Math.max(1, Math.min(idleMs - idle, 1e3)));
+				timer.unref?.();
+			};
+			ended.then(() => {
+				clearTimeout(timer);
+				resolve();
+			});
+			check();
+		});
+	};
+	return {
+		source: tracked,
+		settle
+	};
+}
+async function* withAbort(iter, signal) {
+	if (!signal) {
+		yield* iter;
+		return;
+	}
+	for await (const chunk of iter) {
+		if (signal.aborted) throw abortReason$1(signal);
+		yield chunk;
+	}
+}
+//#endregion
+//#region ../webrun-rpc/dist/index.js
+const closeSignals = /* @__PURE__ */ new WeakMap();
+/**
+* Internal: register a port's close signal. Called once by `bindBytesToPort`.
+*
+* @internal
+*/
+function setPortCloseSignal(port, signal) {
+	closeSignals.set(port, signal);
+}
+/**
+* Return the AbortSignal that fires when `port`'s transport closes, or
+* `undefined` if `port` is not transport-backed (e.g., a raw
+* `MessageChannel().port1`).
+*/
+function getPortCloseSignal(port) {
+	return closeSignals.get(port);
+}
+/**
+* Pass as `timeout` to install no deadline at all. Used by the stream tier,
+* where the deadline belongs to the stream rather than to one chunk (spec D8):
+* a slow consumer is throttled, never failed.
+*/
+const NO_TIMEOUT = Number.POSITIVE_INFINITY;
+/**
+* Asynchronous request/response over any `MessageTarget`.
+*
+* Sends `params` to the peer listening with `listenPort`, waits up to
+* `timeout` ms for a matching reply, and either resolves with the result or
+* rejects with the deserialised error.
+*/
+function callPort(port, params, { timeout = 1e3, channelName = "", log = () => {}, newCallId = () => `call-${Date.now()}-${String(Math.random()).substring(2)}`, signal } = {}) {
+	const callId = newCallId();
+	log("[callPort]", {
+		channelName,
+		callId,
+		params
+	});
+	const combinedSignal = combineSignals(signal, getPortCloseSignal(port));
+	let timerId;
+	let onMessage;
+	let onAbort;
+	const promise = new Promise((resolve, reject) => {
+		if (combinedSignal?.aborted) {
+			reject(abortReason(combinedSignal));
+			return;
+		}
+		if (Number.isFinite(timeout) && timeout > 0) timerId = setTimeout(() => reject(/* @__PURE__ */ new Error(`Call timeout. CallId: "${callId}".`)), timeout);
+		onMessage = (event) => {
+			const data = event.data;
+			if (!data) return;
+			if (data.channelName !== channelName) return;
+			if (data.callId !== callId) return;
+			if (data.type === "response:error") reject(deserializeError(data.error));
+			else if (data.type === "response:result") resolve(data.result);
+		};
+		port.addEventListener("message", onMessage);
+		if (combinedSignal) {
+			onAbort = () => reject(abortReason(combinedSignal));
+			combinedSignal.addEventListener("abort", onAbort, { once: true });
+		}
+	});
+	promise.catch(() => {}).finally(() => {
+		if (timerId !== void 0) clearTimeout(timerId);
+		if (onMessage) port.removeEventListener("message", onMessage);
+		if (onAbort && combinedSignal) combinedSignal.removeEventListener("abort", onAbort);
+	});
+	port.postMessage({
+		type: "request",
+		channelName,
+		callId,
+		params
+	});
+	return promise;
+}
+function abortReason(signal) {
+	const reason = signal.reason;
+	if (reason instanceof Error) return reason;
+	const err = new Error(reason === void 0 ? "Aborted" : String(reason));
+	err.name = "AbortError";
+	return err;
+}
+function combineSignals(...signals) {
+	const live = signals.filter((s) => s !== void 0);
+	if (live.length === 0) return void 0;
+	if (live.length === 1) return live[0];
+	return AbortSignal.any(live);
+}
+/**
+* Installs `handler` as the server side of a `callPort` / `listenPort`
+* request/response pair on `port`.
+*
+* Returns a cleanup function that removes the listener.
+*/
+function listenPort(port, handler, { channelName = "", log = () => {} } = {}) {
+	const onMessage = async (event) => {
+		const data = event.data;
+		if (!data || data.channelName !== channelName || data.type !== "request") return;
+		const { callId, params } = data;
+		log("[listenPort]", {
+			channelName,
+			callId,
+			params
+		});
+		let result;
+		let error;
+		let type;
+		try {
+			result = await handler(params);
+			type = "response:result";
+		} catch (e) {
+			error = serializeError(e);
+			type = "response:error";
+		}
+		port.postMessage({
+			callId,
+			channelName,
+			type,
+			result,
+			error
+		});
+	};
+	port.addEventListener("message", onMessage);
+	return () => port.removeEventListener("message", onMessage);
+}
+/**
+* Wraps an async iterable so that an `AbortSignal` firing causes the wrapper
+* to return cleanly, forwarding `return()` to the underlying iterator so the
+* producer (e.g., a user-supplied generator) sees its own `finally` blocks
+* run immediately rather than waiting for the next yield.
+*/
+async function* throughAbort(input, signal) {
+	const iter = input[Symbol.asyncIterator] ? input[Symbol.asyncIterator]() : input[Symbol.iterator]();
+	const onAbort = () => {
+		iter.return?.(void 0);
+	};
+	if (signal.aborted) {
+		iter.return?.(void 0);
+		return;
+	}
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		while (true) {
+			const r = await iter.next();
+			if (r.done) return;
+			if (signal.aborted) return;
+			yield r.value;
+		}
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+/**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable$1(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+/**
+* `gen`, except that `return()` and `throw()` take effect at once.
+*
+* On an async generator both are queued behind a `next()` that is still
+* pending: a consumer that gives up on a stream while it waits for the peer's
+* next chunk — an aborted fetch whose response head has not come, say — cannot
+* end it until that chunk arrives, which for a peer that never answers is
+* never. The stream's `finally` (which closes its port and tells the peer)
+* then never runs, and on a multiplexer the port is kept for good.
+*
+* So `abandon` runs first, synchronously: it must make the pending `next()`
+* settle (abort the stream), which then resolves done, after which the
+* generator's own `return()` / `throw()` proceeds as usual. On a generator
+* suspended at a `yield` it is the same ending, a step earlier. `abandon` runs once, whichever comes first.
+*/
+function returningAtOnce(gen, abandon) {
+	let abandoned = false;
+	const giveUp = (reason) => {
+		if (abandoned) return;
+		abandoned = true;
+		abandon(reason);
+	};
+	const wrapped = {
+		next: (...args) => gen.next(...args).catch((error) => {
+			if (abandoned) return {
+				done: true,
+				value: void 0
+			};
+			throw error;
+		}),
+		return(value) {
+			giveUp();
+			return gen.return(value);
+		},
+		throw(error) {
+			giveUp(error);
+			return gen.throw(error);
+		},
+		[Symbol.asyncIterator]() {
+			return wrapped;
+		}
+	};
+	return asyncDisposable$1(wrapped, () => wrapped.return(void 0));
+}
+/**
+* The `type` of the out-of-band notice a side posts when it abandons a stream.
+*
+* Layer 1's `close` is not observable to layer 2 — a closed virtual port drops
+* its listeners silently and is indistinguishable from a working port nobody
+* is answering — so the peer would otherwise wait forever. Exported because
+* tests and adapters assert on it.
+*/
+const STREAM_ABORT = "webrun-rpc:stream-abort";
+/** Caller's input travels on this channel; the handler listens on it. */
+const CHANNEL_IN = "in";
+/** The handler's output travels on this channel; the caller listens on it. */
+const CHANNEL_OUT = "out";
+/**
+* One port in, one `Duplex` out (spec D9).
+*
+* The returned `Duplex` runs a single stream on `port`: the caller's `input`
+* is sent chunk by chunk with `callPort`, and the handler's output arrives the
+* same way on the other channel. Within each direction the next chunk is never
+* sent until the previous one has been delivered *and* pulled past by the
+* consumer (spec D11) — the reply to a chunk call *is* the confirmation, and
+* `listenPort` withholds it until then.
+*
+* A stream port carries exactly one invocation. To make several calls, open
+* several ports: `mux.openPort({ kind: "stream" })` per call.
+*/
+function duplexOverPort(port, options = {}) {
+	return (input) => runCallerSide(port, input, options);
+}
+/**
+* Installs `handler` as the serving side of one stream on `port`. Returns an
+* idempotent teardown that abandons the stream and notifies the peer.
+*/
+function serveDuplexOverPort(port, handler, options = {}) {
+	const controller = new AbortController();
+	const notice = installAbortNotice(port, controller);
+	abortOnPortClose(port, controller);
+	const clock = installStreamTimeout(controller, options.timeout);
+	const inbound = receiveChunks(port, CHANNEL_IN, controller, clock.touch);
+	let output;
+	try {
+		output = handler(inbound.stream);
+	} catch (err) {
+		const pump = sendChunks(port, CHANNEL_OUT, failing(err), options, controller.signal, clock.touch);
+		pump.catch(() => {});
+		disarmClockWhenBothSidesSettle(clock, pump, inbound.ended);
+		return teardownOnce(controller, notice, clock, inbound, void 0);
+	}
+	const pump = sendChunks(port, CHANNEL_OUT, output, options, controller.signal, clock.touch);
+	pump.catch(() => {});
+	disarmClockWhenBothSidesSettle(clock, pump, inbound.ended);
+	return teardownOnce(controller, notice, clock, inbound, output);
+}
+/**
+* A stream that completes normally has nobody left to call the returned
+* teardown — the caller only knows the stream ended, not that it must also
+* dispose the serve-side handle. Without this, the last `touch()`'s timer
+* stays armed for up to `timeout` ms after real completion, doing nothing
+* but holding the event loop open.
+*
+* Only disarms once BOTH `pump` (our output) and `inboundEnded` (the peer's
+* declared end of input, or an abort) have settled. Disarming on `pump`
+* alone is not safe: under half-close the handler can finish producing
+* output while the caller is still sending input, and a clock stopped then
+* would leave that still-open half with no deadline at all — worse than the
+* leak this fixes.
+*/
+function disarmClockWhenBothSidesSettle(clock, pump, inboundEnded) {
+	Promise.allSettled([pump, inboundEnded]).then(() => {
+		clock.stop();
+	});
+}
+async function* failing(err) {
+	throw err;
+}
+function teardownOnce(controller, notice, clock, inbound, output) {
+	let torn = false;
+	return () => {
+		if (torn) return;
+		torn = true;
+		if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: stream torn down"));
+		notice.post();
+		notice.stop();
+		clock.stop();
+		inbound.stop();
+		output?.return(void 0).catch(() => {});
+	};
+}
+function runCallerSide(port, input, options) {
+	const controller = new AbortController();
+	const notice = installAbortNotice(port, controller);
+	abortOnPortClose(port, controller);
+	const clock = installStreamTimeout(controller, options.timeout);
+	const inbound = receiveChunks(port, CHANNEL_OUT, controller, clock.touch);
+	const pump = sendChunks(port, CHANNEL_IN, input, options, controller.signal, clock.touch);
+	pump.catch(() => {});
+	return returningAtOnce((async function* () {
+		try {
+			yield* inbound.stream;
+		} finally {
+			if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: the caller abandoned the stream"));
+			notice.post();
+			notice.stop();
+			clock.stop();
+			inbound.stop();
+			await pump.catch(() => {});
+			try {
+				await port.close?.();
+			} catch {}
+		}
+	})(), () => {
+		if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: the caller abandoned the stream"));
+	});
+}
+/**
+* Listens for the peer's abort notice, and can post our own. The notice is a
+* plain message with no `channelName` and a `type` that is not `"request"`,
+* so neither `callPort` nor `listenPort` reacts to it, and it carries no
+* numeric `id`, so `structuredCodec` never mistakes it for a layer 1 envelope.
+*/
+function installAbortNotice(port, controller) {
+	const onMessage = (event) => {
+		const data = event.data;
+		if (!data || data.type !== "webrun-rpc:stream-abort") return;
+		if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error("webrun-rpc: the peer abandoned the stream"));
+	};
+	port.addEventListener("message", onMessage);
+	let posted = false;
+	return {
+		post() {
+			if (posted) return;
+			posted = true;
+			try {
+				port.postMessage({ type: STREAM_ABORT });
+			} catch {}
+		},
+		stop() {
+			port.removeEventListener("message", onMessage);
+		}
+	};
+}
+/**
+* Aborts the stream when its port closes underneath it — the multiplexer was
+* closed, or the peer closed the port — for ports that report it (see
+* `getPortCloseSignal`). Without this a stream waiting for the peer's next
+* chunk would wait forever on a port that can no longer deliver one: the
+* outbound half's `callPort` already fails on the close signal, but nothing
+* failed the inbound half.
+*/
+function abortOnPortClose(port, controller) {
+	const closed = getPortCloseSignal(port);
+	if (!closed) return;
+	const onClose = () => {
+		if (!controller.signal.aborted) controller.abort(closed.reason);
+	};
+	if (closed.aborted) {
+		onClose();
+		return;
+	}
+	closed.addEventListener("abort", onClose, { once: true });
+	controller.signal.addEventListener("abort", () => closed.removeEventListener("abort", onClose), { once: true });
+}
+/**
+* The per-stream inactivity timeout (spec D8). Reset by any chunk in either
+* direction; elapsing aborts the stream. Unset, zero or non-finite installs no
+* timer at all, which is the default: a slow consumer is throttled, not failed.
+*/
+function installStreamTimeout(controller, timeout) {
+	if (timeout === void 0 || !Number.isFinite(timeout) || timeout <= 0) return {
+		touch() {},
+		stop() {}
+	};
+	let timer;
+	let stopped = false;
+	const arm = () => {
+		timer = setTimeout(() => {
+			if (!controller.signal.aborted) controller.abort(/* @__PURE__ */ new Error(`webrun-rpc: stream idle for ${timeout} ms`));
+		}, timeout);
+	};
+	arm();
+	return {
+		touch() {
+			if (stopped) return;
+			if (timer !== void 0) clearTimeout(timer);
+			arm();
+		},
+		stop() {
+			stopped = true;
+			if (timer !== void 0) clearTimeout(timer);
+			timer = void 0;
+		}
+	};
+}
+/**
+* The receiving half of one direction.
+*
+* The `listenPort` listener is installed **eagerly**, not lazily inside
+* `recieveIterator`'s installer, because a handler that never drains its input
+* would otherwise leave the peer's chunk calls with nobody to answer them. If
+* the local consumer has not started iterating, an inbound chunk waits for it —
+* which is the correct backpressure, and different from having no listener.
+*/
+function receiveChunks(port, channelName, controller, touch) {
+	let deliver;
+	const waiting = [];
+	let finished = false;
+	let outstanding = false;
+	let poison;
+	let resolveEnded = () => {};
+	const ended = new Promise((resolve) => {
+		resolveEnded = resolve;
+	});
+	let aborted = false;
+	let abortReason;
+	const ready = () => deliver || finished ? Promise.resolve() : new Promise((r) => waiting.push(r));
+	const wake = () => {
+		for (const r of waiting.splice(0)) r();
+	};
+	const off = listenPort(port, async ({ done, value, error }) => {
+		touch();
+		if (poison) throw poison;
+		if (outstanding) {
+			poison = /* @__PURE__ */ new Error("webrun-rpc: peer sent a second unconfirmed chunk; the stream port is closed");
+			controller.abort(poison);
+			setTimeout(() => {
+				try {
+					port.close?.();
+				} catch {}
+			}, 0);
+			throw poison;
+		}
+		outstanding = true;
+		try {
+			await ready();
+			if (finished) throw poison ?? /* @__PURE__ */ new Error("webrun-rpc: the stream is closed");
+			await deliver?.({
+				done,
+				value,
+				error: error ? deserializeError(error) : void 0
+			});
+		} finally {
+			outstanding = false;
+		}
+		if (done) resolveEnded();
+	}, { channelName });
+	const detach = () => {
+		finished = true;
+		wake();
+		off();
+		controller.signal.removeEventListener("abort", onAbort);
+		resolveEnded();
+	};
+	const onAbort = () => {
+		aborted = true;
+		abortReason = controller.signal.reason;
+		finished = true;
+		wake();
+		deliver?.({
+			done: true,
+			error: abortReason
+		});
+		resolveEnded();
+	};
+	controller.signal.addEventListener("abort", onAbort, { once: true });
+	return {
+		stream: recieveIterator((d) => {
+			if (aborted) {
+				d({
+					done: true,
+					error: abortReason
+				});
+				return detach;
+			}
+			deliver = d;
+			wake();
+			return detach;
+		}),
+		stop: detach,
+		ended
+	};
+}
+/**
+* The sending half of one direction: one `callPort` per chunk, one call
+* outstanding at a time (spec D11/D12), with no per-chunk deadline (spec D8).
+*/
+async function sendChunks(port, channelName, output, { maxMessageSize, log }, signal, touch) {
+	const stream = throughAbort(maxMessageSize ? toChunks(maxMessageSize)(output) : output, signal);
+	try {
+		await sendIterator(async ({ done, value, error }) => {
+			if (signal.aborted) return;
+			const chunk = {
+				done,
+				value,
+				error: error === void 0 ? void 0 : serializeError(error)
+			};
+			log?.("[duplexOverPort] send", {
+				channelName,
+				done,
+				size: value?.byteLength
+			});
+			await callPort(port, chunk, {
+				channelName,
+				timeout: NO_TIMEOUT,
+				signal
+			});
+			touch();
+		}, stream);
+	} catch (err) {
+		if (signal.aborted) return;
+		throw err;
+	}
+}
+/**
+* One virtual port.
+*
+* `deliver` and `markClosed` are deliberately not on `port`: the consumer holds
+* only a `MessageTarget`, so it cannot forge inbound traffic or close the port
+* out from under the multiplexer's bookkeeping.
+*/
+function newVirtualPort(send, requestClose) {
+	const listeners = /* @__PURE__ */ new Set();
+	let closed = false;
+	const closing = new AbortController();
+	const abort = (reason) => {
+		if (closing.signal.aborted) return;
+		closing.abort(reason ?? /* @__PURE__ */ new Error("webrun-rpc: the port was closed"));
+	};
+	const port = {
+		addEventListener(_type, listener) {
+			listeners.add(listener);
+		},
+		removeEventListener(_type, listener) {
+			listeners.delete(listener);
+		},
+		postMessage(message, transfer) {
+			if (closed) return;
+			send(message, transfer);
+		},
+		close() {
+			if (closed) return;
+			closed = true;
+			const notify = requestClose;
+			listeners.clear();
+			notify();
+			abort();
+		}
+	};
+	setPortCloseSignal(port, closing.signal);
+	return {
+		port,
+		deliver(payload) {
+			if (closed) return;
+			const event = new MessageEvent("message", { data: payload });
+			for (const listener of [...listeners]) try {
+				listener(event);
+			} catch {}
+		},
+		markClosed(reason) {
+			closed = true;
+			listeners.clear();
+			abort(reason);
+		},
+		isClosed() {
+			return closed;
+		}
+	};
+}
+/**
+* The message of the error that fails the calls still in flight on a
+* multiplexer when it is closed (`PortMux.close()`).
+*/
+const MUX_CLOSED_MESSAGE = "webrun-rpc: the multiplexer was closed";
+/** Ceiling on concurrently open virtual ports. Bounds the id table only. */
+const DEFAULT_MAX_PORTS = 1024;
+/**
+* The default `PortMux`: emulates multiplexing over a single port.
+*
+* A transport that already multiplexes natively supplies its own `PortMux`
+* instead — this implementation is for transports that offer one pipe.
+*/
+function multiplexPort(port, options) {
+	const { codec, onPort, side = "initiator", maxPorts = DEFAULT_MAX_PORTS, maxMessageSize } = options;
+	const open = /* @__PURE__ */ new Map();
+	let nextId = side === "initiator" ? 0 : 1;
+	let muxClosed = false;
+	const post = (envelope, transfer) => {
+		if (muxClosed) return;
+		try {
+			codec.post(port, envelope, transfer);
+		} catch {}
+	};
+	const attach = (id) => {
+		let self;
+		self = newVirtualPort((payload, transfer) => post({
+			type: "message",
+			id,
+			payload
+		}, transfer), (reason) => {
+			post({
+				type: "close",
+				id,
+				reason
+			});
+			open.delete(id);
+			self.markClosed();
+		});
+		open.set(id, self);
+		return self;
+	};
+	const handleEnvelope = (envelope) => {
+		if (muxClosed) return;
+		if (envelope.type === "open") {
+			if (open.has(envelope.id)) return;
+			if (open.size >= maxPorts) {
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "max-ports"
+				});
+				return;
+			}
+			const handle = attach(envelope.id);
+			let accepted = false;
+			if (onPort) try {
+				accepted = onPort(handle.port, envelope.meta) !== false;
+			} catch {
+				accepted = false;
+			}
+			if (!accepted) {
+				open.delete(envelope.id);
+				handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the port was rejected"));
+				post({
+					type: "close",
+					id: envelope.id,
+					reason: "rejected"
+				});
+			}
+			return;
+		}
+		const handle = open.get(envelope.id);
+		if (envelope.type === "message") {
+			if (!handle) return;
+			handle.deliver(envelope.payload);
+			return;
+		}
+		if (!handle) return;
+		open.delete(envelope.id);
+		handle.markClosed(/* @__PURE__ */ new Error("webrun-rpc: the peer closed the port"));
+	};
+	const listener = (event) => {
+		const envelope = codec.read(event);
+		if (envelope) handleEnvelope(envelope);
+	};
+	port.addEventListener("message", listener);
+	port.start?.();
+	return {
+		maxMessageSize,
+		async openPort(meta) {
+			if (muxClosed) throw new Error("webrun-rpc: the multiplexer is closed");
+			if (open.size >= maxPorts) throw new RangeError(`webrun-rpc: maxPorts (${maxPorts}) reached`);
+			while (open.has(nextId)) nextId += 2;
+			const id = nextId;
+			nextId += 2;
+			const handle = attach(id);
+			post({
+				type: "open",
+				id,
+				meta
+			});
+			return handle.port;
+		},
+		async close() {
+			if (muxClosed) return;
+			for (const [id, handle] of [...open]) {
+				post({
+					type: "close",
+					id
+				});
+				open.delete(id);
+				handle.markClosed(/* @__PURE__ */ new Error(MUX_CLOSED_MESSAGE));
+			}
+			muxClosed = true;
+			port.removeEventListener("message", listener);
+			await port.close?.();
+		}
+	};
+}
+/**
+* Announced with every port this pair opens. Layer 1 never reads `meta` — it is
+* here so a peer running something else over the same multiplexer can tell a
+* stream port from whatever else it hands out, and so a packet capture says
+* what the port is for.
+*/
+const STREAM_META = { kind: "stream" };
+/**
+* One port source in, one caller `Duplex` out.
+*
+* A call is a port: the mux allocates one, `duplexOverPort` runs the single
+* invocation on it, and closing the stream closes the port. No stream ids, no
+* framing and no credit accounting live here — the mux owns the first, and
+* `duplexOverPort` owns the one-chunk window that makes memory bounded.
+*/
+const connect = async ({ mux: factory, timeout }) => {
+	const mux = await factory();
+	const streamOptions = {
+		maxMessageSize: mux.maxMessageSize,
+		timeout
+	};
+	const call = (input) => {
+		let stream;
+		let abandoned = false;
+		return returningAtOnce((async function* () {
+			const port = await mux.openPort(STREAM_META);
+			if (abandoned) {
+				await port.close?.();
+				return;
+			}
+			stream = duplexOverPort(port, streamOptions)(input);
+			yield* stream;
+		})(), () => {
+			abandoned = true;
+			stream?.return(void 0).catch(() => {});
+		});
+	};
+	return {
+		call,
+		async close() {
+			await mux.close();
+		}
+	};
+};
+/**
+* One port source in, `handler` serving every call that arrives on it.
+*
+* Each inbound port is one invocation, so the factory's `onPort` is the accept
+* loop: it installs `handler` on the new port and nothing else. The returned
+* teardown abandons the streams still running *before* dropping the mux, so
+* the peer's callers reject with "the peer abandoned the stream" instead of
+* parking forever on a port that has silently gone inert — layer 1's close is
+* not observable to layer 2, which is why the notice has to be posted
+* deliberately.
+*/
+const serve = async ({ mux: factory, timeout }, handler) => {
+	const live = /* @__PURE__ */ new Set();
+	let streamOptions = { timeout };
+	const mux = await factory((port) => {
+		let off;
+		let finished = false;
+		const tracked = (input) => (async function* () {
+			try {
+				yield* handler(input);
+			} finally {
+				finished = true;
+				if (off) live.delete(off);
+			}
+		})();
+		off = serveDuplexOverPort(port, tracked, streamOptions);
+		if (!finished) live.add(off);
+	});
+	streamOptions = {
+		maxMessageSize: mux.maxMessageSize,
+		timeout
+	};
+	let torn = false;
+	return async () => {
+		if (torn) return;
+		torn = true;
+		for (const off of [...live]) {
+			live.delete(off);
+			try {
+				off();
+			} catch {}
+		}
+		await mux.close();
+	};
+};
+/**
+* Ports over ONE PIPE OF BYTES — a `MessagePort`, a worker, a WebSocket.
+*
+* There is no second port to be had, so `multiplexPort`'s id table invents
+* them. Use this when the transport gives you exactly one channel.
+*/
+function overPipe(pipe, options) {
+	return (onPort) => multiplexPort(pipe, {
+		...options,
+		onPort
+	});
+}
+function isEnvelope(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	if (typeof candidate.id !== "number") return false;
+	if (!Number.isInteger(candidate.id) || candidate.id < 0) return false;
+	return candidate.type === "open" || candidate.type === "message" || candidate.type === "close";
+}
+/**
+* For ports whose messages are structured values — a real `MessagePort`, a
+* worker, an iframe.
+*
+* Envelopes are posted as-is, so nothing is encoded, `ArrayBuffer`s move
+* zero-copy through the transfer list, and structured clone does the work the
+* platform already does well. This is a performance choice only: layer 2 may
+* not send anything a byte codec could not also carry.
+*/
+const structuredCodec = {
+	post(port, envelope, transfer) {
+		if (transfer && transfer.length > 0) port.postMessage(envelope, transfer);
+		else port.postMessage(envelope);
+	},
+	read(event) {
+		return isEnvelope(event.data) ? event.data : void 0;
+	}
+};
+//#endregion
+//#region src/link/async-dispose.ts
+/**
+* Makes `target` disposable with `await using`: installs `dispose` as its
+* `[Symbol.asyncDispose]`, where the runtime defines the symbol. Hand-written
+* iterators lose what a native generator gets from `AsyncIteratorPrototype`;
+* this gives it back. A no-op where the symbol is missing. Kept off the
+* declared types, which would require consumers to compile with the
+* `esnext.disposable` lib.
+*/
+function asyncDisposable(target, dispose) {
+	const asyncDispose = Symbol.asyncDispose;
+	if (asyncDispose && !(asyncDispose in target)) Object.defineProperty(target, asyncDispose, {
+		value: async () => {
+			await dispose();
+		},
+		configurable: true,
+		writable: true
+	});
+	return target;
+}
+//#endregion
+//#region src/link/http-link.ts
+/**
+* The version of the HTTP-over-`MessagePort` protocol this package speaks,
+* sent in every hand-shake that sets up a link. Version 1 was this package's
+* own `handleStreams` / `sendStream` (no backpressure); version 2 is
+* webrun-rpc's `connect` / `serve` over `overPipe` with webrun-http-streams'
+* `fetchOverDuplex` / `serveFetchOverDuplex`: one port per link, calls
+* multiplexed on it, each call a stream with a one-chunk window in both
+* directions, and cancellation that reaches the handler.
+*/
+const HTTP_LINK_PROTOCOL = "webrun-http-link/2";
+/**
+* Why a request failed when its link went away under it: the far side (the
+* handler, or the ServiceWorker) was lost. The request may or may not have
+* been applied.
+*/
+var LinkLostError = class extends Error {
+	constructor(message = "The link was lost while this request was in flight") {
+		super(`${message}; it may or may not have been applied.`);
+		this.name = "LinkLostError";
+	}
+};
+/**
+* Posted on a link's port by the calling end when it closes the link, so the
+* answering end can release it: a `MessagePort` never reports that its other
+* end is gone.
+*/
+const LINK_CLOSE = "webrun-http:link-close";
+/** Opens the calling end of a link on `port` (one port per link). */
+async function connectHttpLink(port, { streamTimeout, maxPorts } = {}) {
+	const { call, close } = await connect({
+		mux: overPipe(port, {
+			codec: structuredCodec,
+			side: "initiator",
+			maxPorts
+		}),
+		timeout: streamTimeout
+	});
+	return trackedLink((request) => fetchOverDuplex(call, request), async () => {
+		try {
+			port.postMessage({ type: LINK_CLOSE });
+		} catch {}
+		await close();
+	});
+}
+/**
+* Serves `handler` on the answering end of a link. Resolves with a teardown
+* that abandons the requests still running (their handlers see the
+* cancellation) and releases the port.
+*/
+async function serveHttpLink(port, handler, { streamTimeout, maxPorts, requestIdleMs } = {}) {
+	const teardown = await serve({
+		mux: overPipe(port, {
+			codec: structuredCodec,
+			side: "responder",
+			maxPorts
+		}),
+		timeout: streamTimeout
+	}, serveFetchOverDuplex(async (request) => await handler(request), { requestIdleMs }));
+	const onClose = (event) => {
+		if (event.data?.type === LINK_CLOSE) close();
+	};
+	const close = async () => {
+		port.removeEventListener("message", onClose);
+		await teardown();
+	};
+	port.addEventListener("message", onClose);
+	return close;
+}
+/**
+* Wraps a `send` so the link knows its requests in flight (for draining and
+* load-based routing) and can fail them all at once when it is closed.
+*/
+function trackedLink(send, release) {
+	let inflight = 0;
+	let closed = false;
+	let lostReason;
+	const failers = /* @__PURE__ */ new Set();
+	const idleWaiters = [];
+	const done = () => {
+		inflight--;
+		if (inflight === 0) for (const resolve of idleWaiters.splice(0)) resolve();
+	};
+	const link = {
+		get inflight() {
+			return inflight;
+		},
+		get closed() {
+			return closed;
+		},
+		whenIdle() {
+			return inflight === 0 ? Promise.resolve() : new Promise((r) => idleWaiters.push(r));
+		},
+		async send(request) {
+			if (closed) throw lostReason ?? new LinkLostError("The link is closed");
+			inflight++;
+			let finished = false;
+			const finish = () => {
+				if (finished) return;
+				finished = true;
+				failers.delete(fail);
+				done();
+			};
+			let fail = () => {};
+			const lost = new Promise((_, reject) => {
+				fail = reject;
+			});
+			failers.add(fail);
+			lost.catch(() => {});
+			let response;
+			try {
+				response = await Promise.race([send(request), lost]);
+			} catch (error) {
+				finish();
+				throw lostReason ?? error;
+			}
+			if (!response.body) {
+				finish();
+				return response;
+			}
+			return new Response(guardBody(response.body, lost, () => lostReason, finish), {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			});
+		},
+		async close(reason) {
+			if (closed) return;
+			closed = true;
+			lostReason = reason ?? new LinkLostError("The link was closed");
+			for (const fail of [...failers]) fail(lostReason);
+			try {
+				await release();
+			} catch {}
+		}
+	};
+	return asyncDisposable(link, () => link.close());
+}
+/**
+* A response body that reports its end (done, cancelled or failed) and fails
+* with the link's reason when the link is lost mid-stream.
+*/
+function guardBody(body, lost, reason, finish) {
+	const reader = body.getReader();
+	return new ReadableStream({
+		async pull(controller) {
+			try {
+				const { done, value } = await Promise.race([reader.read(), lost]);
+				if (done) {
+					finish();
+					controller.close();
+					return;
+				}
+				controller.enqueue(value);
+			} catch (error) {
+				finish();
+				reader.cancel().catch(() => {});
+				controller.error(reason() ?? error);
+			}
+		},
+		async cancel(why) {
+			finish();
+			await reader.cancel(why).catch(() => {});
+		}
+	});
+}
+//#endregion
+//#region src/link/locks.ts
+function lockManager() {
+	return globalThis.navigator?.locks;
+}
+function locksAvailable() {
+	return lockManager() !== void 0;
+}
+/** A fresh lock name: `<prefix>:<uuid>`. */
+function newLockName(prefix) {
+	return `${prefix}:${crypto.randomUUID()}`;
+}
+/**
+* Takes the lock `name` and holds it until the returned release is called or
+* this context dies. Resolves once the lock is held; with no Web Locks,
+* resolves at once.
+*/
+async function holdLock(name) {
+	const locks = lockManager();
+	if (!locks) return () => {};
+	let release = () => {};
+	const released = new Promise((resolve) => {
+		release = resolve;
+	});
+	await new Promise((held) => {
+		locks.request(name, {}, () => {
+			held();
+			return released;
+		}).catch(() => held());
+	});
+	return release;
+}
+/**
+* Calls `onLost` once the lock `name` is granted to this context — that is,
+* once whoever holds it is gone — and releases it at once. Returns a function
+* that stops watching. With no Web Locks, never calls `onLost`.
+*/
+function watchLock(name, onLost) {
+	const locks = lockManager();
+	if (!locks) return () => {};
+	const controller = new AbortController();
+	locks.request(name, { signal: controller.signal }, () => {
+		if (!controller.signal.aborted) onLost();
+	}).catch(() => {});
+	return () => controller.abort();
+}
+//#endregion
+//#region src/ws/frames.ts
+/**
+* The wire protocol of a WebSocket carried over a `MessagePort`.
+*
+* A `MessagePort` is a natural carrier for a WebSocket: messages arrive in
+* order, and strings and transferable `ArrayBuffer`s cross it as they are. The
+* protocol on top is these frames, the same in both directions:
+*
+* - `m` — one message. An `ArrayBuffer` is transferred, never copied.
+* - `c` — close. The side that closes first sends it; the other answers with
+*   its own `c` (the echo), and both are then closed cleanly.
+* - `p` — ping, client to server, carrying the client's heartbeat period.
+* - `q` — pong, server to client.
+* - `a` — ack: the receiver consumed `n` more bytes of messages. This is the
+*   flow control: what a side has sent and not yet seen acknowledged is its
+*   `bufferedAmount`, and the server end can wait for it to fall
+*   (`whenDrained`). Added in version 2; version 1 had no backpressure.
+*
+* HEARTBEAT. A `MessagePort` never reports that the other side died, so the
+* client pings every `hb` ms and closes with 1006 when pongs stop for `2·hb`;
+* the server closes with 1006 when pings stop for `3·hb`. That is how a socket
+* notices a closed tab or a terminated worker.
+*
+* Unknown frames are ignored, so a later version can add frames a peer of
+* this version skips.
+*/
+/** The version of this frame protocol. Sent in the upgrade hand-shake. */
+const WS_PORT_PROTOCOL_VERSION = 2;
+/** Default heartbeat period of the client, in ms. */
+const DEFAULT_HEARTBEAT_MS = 1e4;
+/** How long a side waits for the echo of its close frame, in ms. */
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+const defaultTimers = {
+	setTimeout: (fn, ms) => setTimeout(fn, ms),
+	clearTimeout: (id) => clearTimeout(id),
+	setInterval: (fn, ms) => setInterval(fn, ms),
+	clearInterval: (id) => clearInterval(id)
+};
+/** Recovers a frame from a message's data, or `undefined` for anything else. */
+function readFrame(data) {
+	if (typeof data !== "object" || data === null) return void 0;
+	const frame = data;
+	switch (frame.t) {
+		case "m": return typeof frame.d === "string" || frame.d instanceof ArrayBuffer ? frame : void 0;
+		case "c": return {
+			t: "c",
+			code: typeof frame.code === "number" ? frame.code : 1005,
+			reason: typeof frame.reason === "string" ? frame.reason : ""
+		};
+		case "p": {
+			const hb = frame.hb;
+			return {
+				t: "p",
+				hb: typeof hb === "number" && hb > 0 ? hb : DEFAULT_HEARTBEAT_MS
+			};
+		}
+		case "q": return { t: "q" };
+		case "a": {
+			const n = frame.n;
+			return typeof n === "number" && n >= 0 ? {
+				t: "a",
+				n
+			} : void 0;
+		}
+		default: return;
+	}
+}
+/** Posts `frame`, transferring a message's `ArrayBuffer`. */
+function postFrame(port, frame) {
+	if (frame.t === "m" && frame.d instanceof ArrayBuffer) port.postMessage(frame, [frame.d]);
+	else port.postMessage(frame);
+}
+/** The size a message counts for in `bufferedAmount`: UTF-8 bytes, or the buffer's length. */
+function messageSize(data) {
+	return typeof data === "string" ? utf8Length(data) : data.byteLength;
+}
+/** The UTF-8 length of `text`, without encoding it. */
+function utf8Length(text) {
+	let length = 0;
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code < 128) length += 1;
+		else if (code < 2048) length += 2;
+		else if (code >= 55296 && code <= 56319 && i + 1 < text.length) {
+			const next = text.charCodeAt(i + 1);
+			if (next >= 56320 && next <= 57343) {
+				length += 4;
+				i++;
+			} else length += 3;
+		} else length += 3;
+	}
+	return length;
+}
+/**
+* A `CloseEvent` for runtimes that have none: Node 22 has `Event` and
+* `MessageEvent` as globals, but not `CloseEvent`.
+*/
+var WsCloseEvent = class extends Event {
+	code;
+	reason;
+	wasClean;
+	constructor(type, init = {}) {
+		super(type, init);
+		this.code = init.code ?? 0;
+		this.reason = init.reason ?? "";
+		this.wasClean = init.wasClean ?? false;
+	}
+};
+/** A `close` event: the platform's `CloseEvent` where there is one. */
+function newCloseEvent(init) {
+	const Native = globalThis.CloseEvent;
+	return Native ? new Native("close", init) : new WsCloseEvent("close", init);
+}
+/**
+* What both ends of a socket over a `MessagePort` share: the frames, the close
+* handshake, and the byte accounting behind `bufferedAmount`.
+*
+* Not exported from the package: the two ends are `createWebSocketClass`'s
+* class and `ServerWebSocket`.
+*/
+var PortSocketCore = class extends EventTarget {
+	_port;
+	_state = 0;
+	_timers;
+	_closeTimeoutMs;
+	/** Bytes sent and not yet acknowledged by the peer, plus those still being prepared. */
+	_inFlight = 0;
+	/** Bytes of messages "sent" after the socket started closing: counted, never sent. */
+	_discarded = 0;
+	_toAck = 0;
+	_ackScheduled = false;
+	_closeTimer;
+	_drainWaiters = [];
+	constructor(options = {}) {
+		super();
+		this._timers = options.timers ?? defaultTimers;
+		this._closeTimeoutMs = options.closeTimeoutMs ?? 5e3;
+	}
+	get readyState() {
+		return this._state;
+	}
+	/**
+	* Bytes queued by `send()` that the peer has not consumed yet. A peer
+	* acknowledges what it has dispatched, so this falls as the other side reads.
+	*/
+	get bufferedAmount() {
+		return this._inFlight + this._discarded;
+	}
+	/**
+	* Resolves once `bufferedAmount` is at most `limit` (default 0), or the
+	* socket is closed. The backpressure a producer applies:
+	* `if (socket.bufferedAmount > HIGH) await socket.whenDrained(LOW)`.
+	*/
+	whenDrained(limit = 0) {
+		if (this._state === 3 || this._inFlight <= limit) return Promise.resolve();
+		return new Promise((resolve) => this._drainWaiters.push({
+			limit,
+			resolve
+		}));
+	}
+	_attach(port) {
+		this._port = port;
+		port.onmessage = (event) => {
+			const frame = readFrame(event.data);
+			if (frame) this._onFrame(frame);
+		};
+	}
+	_onFrame(frame) {
+		switch (frame.t) {
+			case "m":
+			case "c":
+				this._deliver(frame);
+				return;
+			case "a":
+				this._inFlight = Math.max(0, this._inFlight - frame.n);
+				this._wakeDrainWaiters();
+				return;
+			case "p":
+				this._onPing(frame.hb);
+				return;
+			case "q":
+				this._onPong();
+				return;
+		}
+	}
+	/** A message or close frame the socket is ready to act on. */
+	_deliver(frame) {
+		if (frame.t === "c") {
+			this._onCloseFrame(frame.code, frame.reason);
+			return;
+		}
+		if (this._state !== 1) return;
+		this._dispatchMessage(frame.d);
+		this._consumed(messageSize(frame.d));
+	}
+	_onPing(_hb) {}
+	_onPong() {}
+	_onClosed() {}
+	/** Acknowledge consumed bytes, coalescing the acks of one turn into one frame. */
+	_consumed(bytes) {
+		this._toAck += bytes;
+		if (this._ackScheduled) return;
+		this._ackScheduled = true;
+		queueMicrotask(() => {
+			this._ackScheduled = false;
+			const n = this._toAck;
+			this._toAck = 0;
+			if (n > 0 && this._state !== 3) this._post({
+				t: "a",
+				n
+			});
+		});
+	}
+	/** Reserves `bytes` in `bufferedAmount` for a message still being prepared (a Blob). */
+	_reserve(bytes) {
+		this._inFlight += bytes;
+	}
+	/** Sends one message whose bytes were reserved with `_reserve` (or `reserved = false`). */
+	_sendData(data, reserved = false) {
+		const size = messageSize(data);
+		if (this._state !== 1) {
+			if (reserved) this._inFlight = Math.max(0, this._inFlight - size);
+			this._discarded += size;
+			return;
+		}
+		if (!reserved) this._inFlight += size;
+		this._post({
+			t: "m",
+			d: data
+		});
+	}
+	_post(frame) {
+		try {
+			if (this._port) postFrame(this._port, frame);
+		} catch {}
+	}
+	/** Starts the close handshake. */
+	_startClose(code, reason) {
+		if (this._state === 2 || this._state === 3) return;
+		this._state = 2;
+		this._post({
+			t: "c",
+			code,
+			reason
+		});
+		this._closeTimer = this._timers.setTimeout(() => this._finish(1006, "", false), this._closeTimeoutMs);
+	}
+	_onCloseFrame(code, reason) {
+		if (this._state === 3) return;
+		if (this._state === 2) {
+			this._finish(code, reason, true);
+			return;
+		}
+		this._state = 2;
+		this._post({
+			t: "c",
+			code,
+			reason
+		});
+		this._finish(code, reason, true);
+	}
+	/** The socket is closed: release the port and tell the listeners. */
+	_finish(code, reason, wasClean, error = false) {
+		if (this._state === 3) return;
+		this._state = 3;
+		if (this._closeTimer !== void 0) this._timers.clearTimeout(this._closeTimer);
+		this._closeTimer = void 0;
+		this._onClosed();
+		if (this._port) {
+			this._port.onmessage = null;
+			try {
+				this._port.close();
+			} catch {}
+		}
+		this._wakeDrainWaiters();
+		if (error) this.dispatchEvent(new Event("error"));
+		this.dispatchEvent(newCloseEvent({
+			code,
+			reason,
+			wasClean
+		}));
+	}
+	_wakeDrainWaiters() {
+		if (this._drainWaiters.length === 0) return;
+		const closed = this._state === 3;
+		this._drainWaiters = this._drainWaiters.filter(({ limit, resolve }) => {
+			if (!closed && this._inFlight > limit) return true;
+			resolve();
+			return false;
+		});
+	}
+};
+/** Copies `data` into a fresh `ArrayBuffer`: `send()` must never detach the caller's buffer. */
+function toArrayBuffer(data) {
+	if (data instanceof ArrayBuffer) return data.slice(0);
+	const copy = new Uint8Array(data.byteLength);
+	copy.set(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+	return copy.buffer;
+}
+function isBinary(data) {
+	return data instanceof ArrayBuffer || ArrayBuffer.isView(data);
+}
+function isBlob(data) {
+	return typeof Blob !== "undefined" && data instanceof Blob;
+}
+/** Valid close codes for an application to send: 1000, or 3000–4999. */
+function isApplicationCloseCode(code) {
+	return code === 1e3 || code >= 3e3 && code <= 4999;
+}
+//#endregion
+//#region src/ws/client.ts
+/** RFC 7230 `token`: what a subprotocol name may be. */
+const TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+/**
+* A WHATWG-compatible `WebSocket` class whose transport is a `MessagePort`
+* from `connect`. Code written against the browser's `WebSocket` runs on it
+* unchanged:
+*
+* ```ts
+* const WS = createWebSocketClass(adapter.connectWebSocket);
+* const ws = new WS(`${baseUrl}chat`, ["v1"]);
+* ws.onmessage = (event) => console.log(event.data);
+* ```
+*
+* It validates as the standard does (url, scheme, fragment, subprotocol
+* tokens and duplicates, close codes and reasons), has `binaryType`, the `on*`
+* handlers next to `addEventListener`, and the close handshake.
+* `bufferedAmount` is real: the server acknowledges what it consumed.
+*
+* The real `globalThis.WebSocket` is left alone; install the class where you
+* want it.
+*/
+function createWebSocketClass(connect, options = {}) {
+	const heartbeatMs = options.heartbeatMs ?? 1e4;
+	class WebSocketOverPort extends PortSocketCore {
+		static CONNECTING = 0;
+		static OPEN = 1;
+		static CLOSING = 2;
+		static CLOSED = 3;
+		CONNECTING = 0;
+		OPEN = 1;
+		CLOSING = 2;
+		CLOSED = 3;
+		url;
+		extensions = "";
+		_protocol = "";
+		_binaryType = "blob";
+		_handlers = {};
+		_heartbeat;
+		/** When the oldest ping still waiting for its pong was sent. */
+		_unansweredSince;
+		_onVisibility;
+		/** Sends waiting for a Blob ahead of them to be read, so order is kept. */
+		_chain;
+		constructor(url, protocols = []) {
+			super({
+				timers: options.timers,
+				closeTimeoutMs: options.closeTimeoutMs
+			});
+			this.url = parseUrl(url);
+			const list = typeof protocols === "string" ? [protocols] : [...protocols];
+			validateProtocols(list);
+			for (const type of [
+				"open",
+				"message",
+				"error",
+				"close"
+			]) this.addEventListener(type, (event) => this._handlers[type]?.call(this, event));
+			Promise.resolve().then(() => connect(this.url, list)).then((connection) => {
+				try {
+					this._opened(connection, list);
+				} catch {
+					this._failed();
+				}
+			}, () => this._failed());
+		}
+		get protocol() {
+			return this._protocol;
+		}
+		get binaryType() {
+			return this._binaryType;
+		}
+		set binaryType(value) {
+			if (value === "blob" || value === "arraybuffer") this._binaryType = value;
+		}
+		get onopen() {
+			return this._handlers.open ?? null;
+		}
+		set onopen(fn) {
+			this._handlers.open = typeof fn === "function" ? fn : null;
+		}
+		get onmessage() {
+			return this._handlers.message ?? null;
+		}
+		set onmessage(fn) {
+			this._handlers.message = typeof fn === "function" ? fn : null;
+		}
+		get onerror() {
+			return this._handlers.error ?? null;
+		}
+		set onerror(fn) {
+			this._handlers.error = typeof fn === "function" ? fn : null;
+		}
+		get onclose() {
+			return this._handlers.close ?? null;
+		}
+		set onclose(fn) {
+			this._handlers.close = typeof fn === "function" ? fn : null;
+		}
+		send(data) {
+			if (this._state === 0) throw new DOMException("Still in CONNECTING state.", "InvalidStateError");
+			if (isBlob(data)) {
+				const size = data.size;
+				if (this._state !== 1) {
+					this._sendData(new ArrayBuffer(size));
+					return;
+				}
+				this._reserve(size);
+				this._enqueue(async () => this._sendData(await data.arrayBuffer(), true));
+				return;
+			}
+			const payload = isBinary(data) ? toArrayBuffer(data) : String(data);
+			if (this._chain) this._enqueue(async () => this._sendData(payload));
+			else this._sendData(payload);
+		}
+		close(code, reason) {
+			if (code !== void 0 && !isApplicationCloseCode(code)) throw new DOMException(`The close code must be 1000 or in 3000-4999; ${code} is neither.`, "InvalidAccessError");
+			const text = reason ?? "";
+			if (utf8Length(text) > 123) throw new DOMException("The close reason is longer than 123 bytes.", "SyntaxError");
+			if (this._state === 2 || this._state === 3) return;
+			if (this._state === 0) {
+				this._state = 2;
+				return;
+			}
+			this._startClose(code ?? 1005, text);
+		}
+		_dispatchMessage(data) {
+			const value = typeof data === "string" || this._binaryType === "arraybuffer" ? data : new Blob([data]);
+			this.dispatchEvent(new MessageEvent("message", {
+				data: value,
+				origin: new URL(this.url).origin
+			}));
+		}
+		_onPong() {
+			this._unansweredSince = void 0;
+		}
+		_onClosed() {
+			if (this._heartbeat !== void 0) this._timers.clearInterval(this._heartbeat);
+			this._heartbeat = void 0;
+			if (this._onVisibility) globalThis.document?.removeEventListener("visibilitychange", this._onVisibility);
+		}
+		_ping(hb = heartbeatMs) {
+			this._unansweredSince ??= Date.now();
+			this._post({
+				t: "p",
+				hb
+			});
+		}
+		_opened(connection, requested) {
+			const { port, protocol = "" } = connection ?? {};
+			if (!port || typeof port.postMessage !== "function") {
+				this._failed();
+				return;
+			}
+			if (this._state !== 0) {
+				try {
+					port.postMessage({
+						t: "c",
+						code: 1006,
+						reason: ""
+					});
+					port.close();
+				} catch {}
+				this._finish(1006, "", false, true);
+				return;
+			}
+			if (protocol !== "" && !requested.includes(protocol)) {
+				port.close();
+				this._failed();
+				return;
+			}
+			this._protocol = protocol;
+			this._attach(port);
+			this._state = 1;
+			this._ping();
+			this._heartbeat = this._timers.setInterval(() => {
+				const since = this._unansweredSince;
+				if (since !== void 0 && Date.now() - since > 2 * heartbeatMs) {
+					this._finish(1006, "", false, true);
+					return;
+				}
+				this._ping();
+			}, heartbeatMs);
+			const doc = globalThis.document;
+			if (doc) {
+				this._onVisibility = () => this._ping(doc.visibilityState === "hidden" ? Math.max(heartbeatMs, 7e4) : heartbeatMs);
+				doc.addEventListener("visibilitychange", this._onVisibility);
+				if (doc.visibilityState === "hidden") this._onVisibility();
+			}
+			this.dispatchEvent(new Event("open"));
+		}
+		_failed() {
+			this._state = 2;
+			this._finish(1006, "", false, true);
+		}
+		_enqueue(task) {
+			const run = (this._chain ?? Promise.resolve()).then(task).catch(() => {});
+			this._chain = run;
+			run.then(() => {
+				if (this._chain === run) this._chain = void 0;
+			});
+		}
+	}
+	return WebSocketOverPort;
+}
+function parseUrl(input) {
+	let url;
+	try {
+		url = new URL(`${input}`, globalThis.location?.href);
+	} catch {
+		throw new DOMException(`The URL '${input}' is invalid.`, "SyntaxError");
+	}
+	if (url.protocol === "http:") url.protocol = "ws:";
+	else if (url.protocol === "https:") url.protocol = "wss:";
+	if (url.protocol !== "ws:" && url.protocol !== "wss:") throw new DOMException(`The URL's scheme must be 'ws', 'wss', 'http' or 'https'; '${url.protocol.slice(0, -1)}' is not allowed.`, "SyntaxError");
+	if (url.hash !== "" || `${input}`.includes("#")) throw new DOMException(`The URL contains a fragment identifier ('${url.hash}'). Fragment identifiers are not allowed in WebSocket URLs.`, "SyntaxError");
+	return url.href;
+}
+function validateProtocols(protocols) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const protocol of protocols) {
+		if (!TOKEN.test(protocol)) throw new DOMException(`The subprotocol '${protocol}' is invalid.`, "SyntaxError");
+		if (seen.has(protocol)) throw new DOMException(`The subprotocol '${protocol}' is duplicated.`, "SyntaxError");
+		seen.add(protocol);
+	}
+}
+//#endregion
+//#region src/link/errors.ts
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/link/rendezvous.ts
+/**
+* Matches replies to requests by id, for the control messages that hand
+* WebSocket ports across: each waiting request has a deadline, and all of a
+* peer's waiting requests can be failed at once when the peer is lost.
+*/
+var PortRendezvous = class {
+	_prefix;
+	_waiting = /* @__PURE__ */ new Map();
+	_counter = 0;
+	constructor(_prefix = "r") {
+		this._prefix = _prefix;
+	}
+	/** A fresh id for a request. */
+	newId() {
+		return `${this._prefix}:${++this._counter}`;
+	}
+	get size() {
+		return this._waiting.size;
+	}
+	/** Waits for the reply to `id`, failing after `timeoutMs`. */
+	wait(id, timeoutMs, describe = "the reply") {
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				this._waiting.delete(id);
+				reject(/* @__PURE__ */ new Error(`No answer to ${describe} within ${timeoutMs} ms`));
+			}, timeoutMs);
+			this._waiting.set(id, {
+				resolve,
+				reject,
+				timer
+			});
+		});
+	}
+	/** Delivers the reply to `id`. `false` when nobody waits for it (it timed out). */
+	settle(id, value) {
+		const waiting = this._waiting.get(id);
+		if (!waiting) return false;
+		this._waiting.delete(id);
+		clearTimeout(waiting.timer);
+		waiting.resolve(value);
+		return true;
+	}
+	fail(id, error) {
+		const waiting = this._waiting.get(id);
+		if (!waiting) return;
+		this._waiting.delete(id);
+		clearTimeout(waiting.timer);
+		waiting.reject(error);
+	}
+	failAll(error) {
+		for (const id of [...this._waiting.keys()]) this.fail(id, error);
+	}
+};
+//#endregion
+//#region src/ws/server.ts
+/**
+* The server end of a socket over a `MessagePort`: what a handler gets from
+* `upgradeWebSocket` and talks to.
+*
+* - Events are delivered only after `accept()`; frames that arrive earlier are
+*   queued. Pings are answered even before `accept()`, so a slow handler does
+*   not look like a dead one.
+* - Messages arrive as strings or `ArrayBuffer`s.
+* - `bufferedAmount` counts what the client has not consumed yet, and
+*   `whenDrained(limit)` waits for it to fall: the backpressure a producer
+*   applies.
+* - When the client's pings stop for three heartbeat periods (a closed tab, a
+*   terminated worker), the socket closes with 1006.
+*/
+var ServerWebSocket = class extends PortSocketCore {
+	static CONNECTING = 0;
+	static OPEN = 1;
+	static CLOSING = 2;
+	static CLOSED = 3;
+	url;
+	protocol;
+	_accepted = false;
+	_queue = [];
+	_heartbeatMs = DEFAULT_HEARTBEAT_MS;
+	_lastPing = Date.now();
+	_watch;
+	constructor(port, options = {}) {
+		super({
+			timers: options.timers,
+			closeTimeoutMs: options.closeTimeoutMs
+		});
+		this.url = options.url ?? "";
+		this.protocol = options.protocol ?? "";
+		this._attach(port);
+		this._state = 1;
+		this._watchHeartbeat();
+	}
+	/** Whether `accept()` was called. */
+	get accepted() {
+		return this._accepted;
+	}
+	/** Starts delivering events, the queued ones first. */
+	accept() {
+		if (this._accepted) return;
+		this._accepted = true;
+		for (const frame of this._queue.splice(0)) super._deliver(frame);
+	}
+	send(data) {
+		if (!this._accepted) throw new DOMException("accept() the socket before sending on it.", "InvalidStateError");
+		this._sendData(isBinary(data) ? toArrayBuffer(data) : String(data));
+	}
+	close(code = 1e3, reason = "") {
+		if (!isSendableCloseCode(code)) throw new DOMException(`${code} is not a close code an endpoint may send.`, "InvalidAccessError");
+		if (utf8Length(reason) > 123) throw new DOMException("The close reason is longer than 123 bytes.", "SyntaxError");
+		this._startClose(code, reason);
+	}
+	_deliver(frame) {
+		if (!this._accepted) {
+			this._queue.push(frame);
+			return;
+		}
+		super._deliver(frame);
+	}
+	_dispatchMessage(data) {
+		this.dispatchEvent(new MessageEvent("message", { data }));
+	}
+	_onPing(hb) {
+		this._post({ t: "q" });
+		this._lastPing = Date.now();
+		if (hb !== this._heartbeatMs) {
+			this._heartbeatMs = hb;
+			this._watchHeartbeat();
+		}
+	}
+	_onClosed() {
+		if (this._watch !== void 0) this._timers.clearInterval(this._watch);
+		this._watch = void 0;
+	}
+	_watchHeartbeat() {
+		if (this._watch !== void 0) this._timers.clearInterval(this._watch);
+		this._watch = this._timers.setInterval(() => {
+			if (Date.now() - this._lastPing > 3 * this._heartbeatMs) this._finish(1006, "", false, true);
+		}, this._heartbeatMs);
+	}
+};
+/** Codes an endpoint may put in a close frame (RFC 6455 §7.4). */
+function isSendableCloseCode(code) {
+	if (!Number.isInteger(code)) return false;
+	if (code >= 3e3 && code <= 4999) return true;
+	return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006;
+}
+//#endregion
+//#region src/ws/upgrade.ts
+/**
+* The upgrade, as an HTTP exchange: a `GET` with `Upgrade: websocket` goes to
+* an ordinary `(Request) => Response` handler, and a `101` answer carrying a
+* server socket means accepted. Anything else is a refusal, with its status.
+*
+* FORBIDDEN HEADERS. A browser drops `Upgrade`, `Connection` and every
+* `Sec-*` header from a `new Request()`. The upgrade request therefore carries
+* its headers as an own `headers` property, a standalone `Headers` that keeps
+* them, so handler code reads `request.headers.get("upgrade")` as usual.
+*
+* NO 101 IN A `Response`. The constructor refuses statuses below 200, so the
+* response `upgradeWebSocket` returns reports 101 through an own `status`
+* property; the port that goes back to the caller is found with `takePort`.
+*/
+/** The request header carrying the client's version of the frame protocol. */
+const WS_VERSION_HEADER = "x-webrun-ws-version";
+/**
+* The `GET` a handler sees for `new WebSocket(url, protocols)`. A `ws:` or
+* `wss:` url is given as `http:` or `https:`, as a server sees it.
+*/
+function newWebSocketUpgradeRequest(url, { protocols = [], headers } = {}) {
+	const httpUrl = new URL(`${url}`);
+	if (httpUrl.protocol === "ws:") httpUrl.protocol = "http:";
+	else if (httpUrl.protocol === "wss:") httpUrl.protocol = "https:";
+	const all = new Headers(headers);
+	all.set("upgrade", "websocket");
+	all.set("connection", "Upgrade");
+	all.set("sec-websocket-version", "13");
+	if (!all.has("sec-websocket-key")) all.set("sec-websocket-key", randomKey());
+	if (protocols.length > 0) all.set("sec-websocket-protocol", protocols.join(", "));
+	if (!all.has("x-webrun-ws-version")) all.set(WS_VERSION_HEADER, `2`);
+	return withHeaders(new Request(httpUrl, {
+		method: "GET",
+		headers: all
+	}), all);
+}
+/**
+* Re-attaches `headers` to `request` as its own `headers` property, keeping
+* the forbidden ones a browser dropped. Returns `request`.
+*/
+function withHeaders(request, headers) {
+	Object.defineProperty(request, "headers", {
+		value: headers,
+		configurable: true
+	});
+	return request;
+}
+/** Whether `request` asks for a WebSocket. */
+function isWebSocketUpgrade(request) {
+	return request.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+/** The subprotocols `request` asks for, in order of preference. */
+function requestedProtocols(request) {
+	const header = request.headers.get("sec-websocket-protocol");
+	if (!header) return [];
+	return header.split(",").map((protocol) => protocol.trim()).filter((protocol) => protocol !== "");
+}
+/**
+* Where a response from `upgradeWebSocket` keeps its port. A registered
+* symbol, not a module-level `WeakMap`: the handler and the host that takes
+* the port often run different bundles of this package (a page's adapter from
+* `dist/sw.js`, its handler code importing `dist/worker.js`), and each bundle
+* has its own copy of every module.
+*/
+const UPGRADE = Symbol.for("webrun-http-browser:websocket-upgrade");
+/**
+* Accepts a WebSocket upgrade in a handler:
+*
+* ```ts
+* if (isWebSocketUpgrade(request)) {
+*   const { socket, response } = upgradeWebSocket(request, { protocol: "v1" });
+*   socket.accept();
+*   socket.addEventListener("message", (event) => socket.send(event.data));
+*   return response;
+* }
+* ```
+*
+* The host takes the client's port from the response with `takePort` and
+* hands it to the caller.
+*/
+function upgradeWebSocket(request, options = {}) {
+	const protocol = options.protocol ?? "";
+	const channel = new MessageChannel();
+	const socket = new ServerWebSocket(channel.port1, {
+		...options,
+		url: request.url,
+		protocol
+	});
+	const response = new Response(null, {
+		status: 200,
+		headers: protocol ? { "sec-websocket-protocol": protocol } : {}
+	});
+	Object.defineProperties(response, {
+		status: {
+			value: 101,
+			configurable: true
+		},
+		statusText: {
+			value: "Switching Protocols",
+			configurable: true
+		},
+		webSocket: {
+			value: socket,
+			configurable: true
+		},
+		[UPGRADE]: {
+			value: {
+				port: channel.port2,
+				protocol
+			},
+			configurable: true,
+			writable: true
+		}
+	});
+	return {
+		socket,
+		response
+	};
+}
+/**
+* The port to hand to the caller, for a response from `upgradeWebSocket`.
+* Taken once: a second call returns `undefined`.
+*/
+function takePort(response) {
+	return takeUpgrade(response)?.port;
+}
+/** `takePort`, with the subprotocol the server picked. */
+function takeUpgrade(response) {
+	const holder = response;
+	const upgrade = holder[UPGRADE];
+	if (upgrade) holder[UPGRADE] = void 0;
+	return upgrade;
+}
+/**
+* Runs an upgrade through `handler`, as a host does when a caller asks for a
+* socket: builds the upgrade request, calls the handler, and either takes the
+* port of a `101` or reports the refusal. A subprotocol the caller did not ask
+* for is a refusal, as in the standard.
+*/
+async function serveWebSocketUpgrade(handler, { url, protocols = [], headers }) {
+	let response;
+	try {
+		response = await handler(newWebSocketUpgradeRequest(url, {
+			protocols,
+			headers
+		}));
+	} catch (error) {
+		return {
+			ok: false,
+			status: 500,
+			message: errorMessage(error)
+		};
+	}
+	const upgrade = takeUpgrade(response);
+	if (!upgrade || response.status !== 101) {
+		upgrade?.port.close();
+		try {
+			await response.body?.cancel();
+		} catch {}
+		return {
+			ok: false,
+			status: response.status,
+			message: `The server refused the upgrade: ${response.status} ${response.statusText}`.trim()
+		};
+	}
+	if (upgrade.protocol !== "" && !protocols.includes(upgrade.protocol)) {
+		upgrade.port.close();
+		return {
+			ok: false,
+			status: 400,
+			message: `The server picked the subprotocol '${upgrade.protocol}', which was not requested.`
+		};
+	}
+	return {
+		ok: true,
+		port: upgrade.port,
+		protocol: upgrade.protocol
+	};
+}
+function randomKey() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return btoa(String.fromCharCode(...bytes));
+}
+//#endregion
+//#region src/sw/handler-endpoint.ts
+/** The message calls through a lost ServiceWorker fail with. */
+const ROUTER_LOST_MESSAGE = "The ServiceWorker was lost while this call was in flight";
+/**
+* The handler's end of its links to the ServiceWorker, the same in a page and
+* in a Dedicated Worker.
+*
+* - Serves `handler` on each link's `down` port, and answers WebSocket
+*   upgrades arriving on its `ctl` port by running them through `handler`.
+* - Sends requests through the router on `up` (`fetch`) and opens sockets to
+*   other handlers over `ctl` (`connectWebSocket`).
+* - Watches the ServiceWorker's router lock. When the ServiceWorker dies, the
+*   links made for it are dropped: calls in flight on them fail with
+*   `LinkLostError` ("may or may not have been applied") instead of hanging,
+*   and new calls wait for a link, asking for one (`requestRelink`) every
+*   `relinkRetryMs` until it comes.
+* - While calls are in flight, calls `keepAlive` every `keepAliveMs`: port
+*   messages are not events, so without it the browser may stop the
+*   ServiceWorker in the middle of a long call.
+*/
+var HandlerEndpoint = class {
+	handler;
+	options;
+	_links = /* @__PURE__ */ new Set();
+	_waiters = [];
+	_sockets = new PortRendezvous("o");
+	_keepAliveTimer;
+	_closed = false;
+	constructor(handler, options = {}) {
+		this.handler = handler;
+		this.options = options;
+	}
+	/** Whether any link is live. */
+	get linked() {
+		return this._links.size > 0;
+	}
+	/** Installs a fresh link made for the router holding `routerLock`. */
+	async link(key, ports, routerLock) {
+		if (this._closed) {
+			for (const port of Object.values(ports)) port?.close();
+			return;
+		}
+		const closeDown = await serveHttpLink(ports.down, this.handler, this.options);
+		const up = ports.up ? await connectHttpLink(ports.up, this.options) : void 0;
+		const link = {
+			key,
+			routerLock,
+			ctl: ports.ctl,
+			up,
+			closeDown,
+			stopWatch: () => {}
+		};
+		if (ports.ctl) ports.ctl.onmessage = (event) => this._onControl(link, event.data);
+		if (routerLock) link.stopWatch = watchLock(routerLock, () => this._routerLost(routerLock));
+		for (const old of [...this._links]) {
+			if (old.key !== key) continue;
+			if (old.routerLock !== routerLock) this._drop(old, new LinkLostError(ROUTER_LOST_MESSAGE));
+			else if (!old.superseded) {
+				old.superseded = true;
+				setTimeout(() => void this._drop(old), this.options.supersededLinkMs ?? 3e4);
+			}
+		}
+		this._links.add(link);
+		for (const wake of this._waiters.splice(0)) wake();
+	}
+	/** Drops the links attached under `key` (all of them without a key). */
+	async unlink(key, reason) {
+		const dropped = [...this._links].filter((link) => key === void 0 || link.key === key);
+		await Promise.all(dropped.map((link) => this._drop(link, reason)));
+	}
+	/** The routers this endpoint has live links for. */
+	routerLocks() {
+		return new Set([...this._links].map((link) => link.routerLock));
+	}
+	/**
+	* Sends `request` through the ServiceWorker's router, as if the browser had
+	* fetched it: it reaches the handler its url routes to.
+	*/
+	async fetch(request) {
+		const link = await this._linkWith("up");
+		this._startKeepAlive();
+		return await link.up.send(request);
+	}
+	/** Opens a socket to the handler `url` routes to, through the ServiceWorker. */
+	async connectWebSocket(url, protocols = []) {
+		const link = await this._linkWith("ctl");
+		const id = this._sockets.newId();
+		const answer = this._sockets.wait(id, this.options.wsConnectTimeoutMs ?? 15e3, `the socket request for ${url}`);
+		link.ctl?.postMessage({
+			t: "ws-open",
+			id,
+			url,
+			protocols
+		});
+		return await answer;
+	}
+	async close() {
+		this._closed = true;
+		if (this._keepAliveTimer) clearInterval(this._keepAliveTimer);
+		await this.unlink(void 0, new LinkLostError("The handler was closed"));
+		for (const wake of this._waiters.splice(0)) wake();
+	}
+	async _drop(link, reason) {
+		if (!this._links.delete(link)) return;
+		link.stopWatch();
+		await link.up?.close(reason);
+		try {
+			await link.closeDown();
+		} catch {}
+		if (link.ctl) {
+			link.ctl.onmessage = null;
+			link.ctl.close();
+		}
+	}
+	_routerLost(routerLock) {
+		const reason = new LinkLostError(ROUTER_LOST_MESSAGE);
+		for (const link of [...this._links]) if (link.routerLock === routerLock) this._drop(link, reason);
+		this._sockets.failAll(reason);
+	}
+	/** A live link with `port`, waiting (and asking) for one when there is none. */
+	async _linkWith(port) {
+		const find = () => [...this._links].filter((link) => !link.superseded).reverse().find((link) => port === "up" ? link.up && !link.up.closed : link.ctl);
+		const found = find();
+		if (found) return found;
+		const retryMs = this.options.relinkRetryMs ?? 2e3;
+		const deadline = Date.now() + (this.options.relinkTimeoutMs ?? 3e4);
+		while (!this._closed) {
+			this.options.requestRelink?.();
+			await new Promise((resolve) => {
+				const timer = setTimeout(resolve, Math.max(0, Math.min(retryMs, deadline - Date.now())));
+				this._waiters.push(() => {
+					clearTimeout(timer);
+					resolve();
+				});
+			});
+			const link = find();
+			if (link) return link;
+			if (Date.now() >= deadline) break;
+		}
+		throw new LinkLostError("No link to the ServiceWorker could be made for this call");
+	}
+	_startKeepAlive() {
+		if (this._keepAliveTimer || !this.options.keepAlive) return;
+		this._keepAliveTimer = setInterval(() => {
+			if ([...this._links].reduce((sum, link) => sum + (link.up?.inflight ?? 0), 0) === 0) {
+				clearInterval(this._keepAliveTimer);
+				this._keepAliveTimer = void 0;
+				return;
+			}
+			this.options.keepAlive?.();
+		}, this.options.keepAliveMs ?? 2e4);
+	}
+	_onControl(link, message) {
+		if (!message || typeof message !== "object") return;
+		switch (message.t) {
+			case "ws-connect":
+				this._acceptSocket(link, message);
+				return;
+			case "ws-opened":
+				if (!this._sockets.settle(message.id, {
+					port: message.port,
+					protocol: message.protocol
+				})) message.port.close();
+				return;
+			case "ws-failed":
+				this._sockets.fail(message.id, new Error(message.message));
+				return;
+		}
+	}
+	async _acceptSocket(link, { id, url, protocols, headers }) {
+		const ctl = link.ctl;
+		if (!ctl) return;
+		try {
+			const result = await serveWebSocketUpgrade(this.handler, {
+				url,
+				protocols,
+				headers
+			});
+			if (result.ok) ctl.postMessage({
+				t: "ws-accept",
+				id,
+				protocol: result.protocol,
+				port: result.port
+			}, [result.port]);
+			else ctl.postMessage({
+				t: "ws-refuse",
+				id,
+				status: result.status,
+				message: result.message
+			});
+		} catch (error) {
+			ctl.postMessage({
+				t: "ws-refuse",
+				id,
+				status: 500,
+				message: errorMessage(error)
+			});
+		}
+	}
+};
+//#endregion
+//#region src/sw/worker-service.ts
+/**
+* Serves `handler` from a Dedicated Worker, on the links the page attaches
+* with `adapter.attachWorker(worker)`:
+*
+* ```ts
+* // worker.ts
+* const service = serveHttpInWorker(async (request) => new Response("hi"));
+* ```
+*
+* The worker holds an owner lock while it lives, so the ServiceWorker notices
+* at once when it is terminated. It watches the ServiceWorker's router lock,
+* and asks its page to attach it again when its links died and a call waits.
+* While calls through the router are in flight it asks its page every 20 s to
+* keep the ServiceWorker awake — only a message to the ServiceWorker object
+* counts as an event, and a worker cannot post one.
+*/
+function serveHttpInWorker(handler, options = {}) {
+	const scope = options.scope ?? globalThis;
+	const ownerLock = newLockName("webrun-http-owner");
+	const held = holdLock(ownerLock);
+	const controls = /* @__PURE__ */ new Set();
+	const tellPages = (message) => {
+		for (const control of controls) control.postMessage(message);
+	};
+	const endpoint = new HandlerEndpoint(handler, {
+		...options,
+		requestRelink: () => tellPages({ type: "relink" }),
+		keepAlive: () => tellPages({ type: "keepalive" })
+	});
+	const onMessage = (event) => {
+		const { data, ports } = event;
+		if (data?.type !== "webrun-http:worker-hello") return;
+		const control = ports?.[0];
+		if (!control) return;
+		controls.add(control);
+		control.onmessage = (message) => {
+			const msg = message.data;
+			if (msg?.type === "link") {
+				const [down, ctl, up] = message.ports;
+				if (down) endpoint.link(msg.key, {
+					down,
+					ctl,
+					up
+				}, msg.routerLock);
+			} else if (msg?.type === "unlink") endpoint.unlink(msg.key);
+		};
+		held.then(() => control.postMessage({
+			type: "ready",
+			ownerLock: locksAvailable() ? ownerLock : void 0
+		}));
+	};
+	scope.addEventListener("message", onMessage);
+	const baseUrl = () => globalThis.location?.href;
+	const connectWebSocket = (url, protocols = []) => {
+		const httpUrl = new URL(`${url}`, baseUrl());
+		if (httpUrl.protocol === "ws:") httpUrl.protocol = "http:";
+		else if (httpUrl.protocol === "wss:") httpUrl.protocol = "https:";
+		return endpoint.connectWebSocket(`${httpUrl}`, protocols);
+	};
+	let WebSocketClass;
+	return {
+		fetch(input, init) {
+			const request = input instanceof Request && init === void 0 ? input : new Request(input instanceof Request ? input : new URL(`${input}`, baseUrl()), init);
+			return endpoint.fetch(request);
+		},
+		connectWebSocket,
+		get WebSocket() {
+			WebSocketClass ??= createWebSocketClass(connectWebSocket, options.webSocket);
+			return WebSocketClass;
+		},
+		get linked() {
+			return endpoint.linked;
+		},
+		async close() {
+			scope.removeEventListener("message", onMessage);
+			await endpoint.close();
+			for (const control of controls) control.close();
+			controls.clear();
+			(await held)();
+		}
+	};
+}
+//#endregion
+export { DEFAULT_CLOSE_TIMEOUT_MS, DEFAULT_HEARTBEAT_MS, HTTP_LINK_PROTOCOL, LinkLostError, ServerWebSocket, WS_PORT_PROTOCOL_VERSION, WS_VERSION_HEADER, WsCloseEvent, connectHttpLink, createWebSocketClass, isWebSocketUpgrade, newWebSocketUpgradeRequest, requestedProtocols, serveHttpInWorker, serveHttpLink, serveWebSocketUpgrade, takePort, takeUpgrade, trackedLink, upgradeWebSocket, withHeaders };